Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe

Overview

General Information

Sample Name:Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
Analysis ID:791299
MD5:17388d36388d280c4e2d724c9ab58002
SHA1:ee660100dfbad59a2796244514bff64c66cd0ca7
SHA256:5f20a33e263b8b8f5388b8e2512d0678312257b8fdf592b8a83aa481076048ca
Infos:

Detection

GuLoader
Score:64
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected GuLoader
Mass process execution to delay analysis
Obfuscated command line found
Uses 32bit PE files
PE file does not import any functions
Sample file is different than original file name gathered from version info
Drops PE files
Tries to load missing DLLs
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
Detected potential crypto function
Too many similar processes found
PE / OLE file has an invalid certificate
Contains functionality to dynamically determine API calls
Creates processes with suspicious names
Found dropped PE file which has not been started or loaded
Creates a process in suspended mode (likely to inject code)
Abnormal high CPU Usage
Contains functionality for read data from the clipboard

Classification

Process Tree

  • System is w10x64
  • Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe (PID: 6056 cmdline: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe MD5: 17388D36388D280C4E2D724C9AB58002)
    • cmd.exe (PID: 6104 cmdline: cmd.exe /c set /A "0x0E^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 6112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 1116 cmdline: cmd.exe /c set /A "0x19^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5136 cmdline: cmd.exe /c set /A "0x05^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5352 cmdline: cmd.exe /c set /A "0x0E^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5348 cmdline: cmd.exe /c set /A "0x07^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5408 cmdline: cmd.exe /c set /A "0x78^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5516 cmdline: cmd.exe /c set /A "0x79^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 4696 cmdline: cmd.exe /c set /A "0x71^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 3424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 1400 cmdline: cmd.exe /c set /A "0x71^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 4912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 4908 cmdline: cmd.exe /c set /A "0x08^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 1852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 1556 cmdline: cmd.exe /c set /A "0x39^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 2360 cmdline: cmd.exe /c set /A "0x2E^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 3384 cmdline: cmd.exe /c set /A "0x2A^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 1176 cmdline: cmd.exe /c set /A "0x3F^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 1540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 688 cmdline: cmd.exe /c set /A "0x2E^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5760 cmdline: cmd.exe /c set /A "0x0D^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5836 cmdline: cmd.exe /c set /A "0x22^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5860 cmdline: cmd.exe /c set /A "0x27^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 4996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 4964 cmdline: cmd.exe /c set /A "0x2E^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 4932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5808 cmdline: cmd.exe /c set /A "0x0A^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5884 cmdline: cmd.exe /c set /A "0x63^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5448 cmdline: cmd.exe /c set /A "0x26^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5736 cmdline: cmd.exe /c set /A "0x6B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5928 cmdline: cmd.exe /c set /A "0x39^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 6136 cmdline: cmd.exe /c set /A "0x7F^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 6132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 684 cmdline: cmd.exe /c set /A "0x6B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 1672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5360 cmdline: cmd.exe /c set /A "0x67^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5316 cmdline: cmd.exe /c set /A "0x6B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5412 cmdline: cmd.exe /c set /A "0x22^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5456 cmdline: cmd.exe /c set /A "0x6B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 4228 cmdline: cmd.exe /c set /A "0x7B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 4768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5008 cmdline: cmd.exe /c set /A "0x33^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 2056 cmdline: cmd.exe /c set /A "0x73^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 4224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 4556 cmdline: cmd.exe /c set /A "0x7B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 496 cmdline: cmd.exe /c set /A "0x7B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 1500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 1296 cmdline: cmd.exe /c set /A "0x7B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 1212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 3092 cmdline: cmd.exe /c set /A "0x7B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 4648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 3236 cmdline: cmd.exe /c set /A "0x7B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5872 cmdline: cmd.exe /c set /A "0x7B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 4988 cmdline: cmd.exe /c set /A "0x7B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 4972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 4920 cmdline: cmd.exe /c set /A "0x67^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5484 cmdline: cmd.exe /c set /A "0x6B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5908 cmdline: cmd.exe /c set /A "0x22^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5732 cmdline: cmd.exe /c set /A "0x6B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 3196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5768 cmdline: cmd.exe /c set /A "0x7B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 2576 cmdline: cmd.exe /c set /A "0x67^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 6040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 6112 cmdline: cmd.exe /c set /A "0x6B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5164 cmdline: cmd.exe /c set /A "0x3B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5152 cmdline: cmd.exe /c set /A "0x6B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5344 cmdline: cmd.exe /c set /A "0x7B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5436 cmdline: cmd.exe /c set /A "0x67^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5380 cmdline: cmd.exe /c set /A "0x6B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 1768 cmdline: cmd.exe /c set /A "0x22^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 3408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 4252 cmdline: cmd.exe /c set /A "0x6B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 576 cmdline: cmd.exe /c set /A "0x7F^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 3780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 1412 cmdline: cmd.exe /c set /A "0x67^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 3988 cmdline: cmd.exe /c set /A "0x6B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 2300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5752 cmdline: cmd.exe /c set /A "0x22^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 1216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 4852 cmdline: cmd.exe /c set /A "0x6B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5760 cmdline: cmd.exe /c set /A "0x7B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 4984 cmdline: cmd.exe /c set /A "0x33^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 4976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5860 cmdline: cmd.exe /c set /A "0x73^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 4928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 4956 cmdline: cmd.exe /c set /A "0x7B^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5808 cmdline: cmd.exe /c set /A "0x67^75" MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • Conhost.exe (PID: 5896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.514197554.0000000000613000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_GuLoader_3Yara detected GuLoaderJoe Security
    Process Memory Space: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe PID: 6056JoeSecurity_GuLoader_3Yara detected GuLoaderJoe Security

      Sigma Signatures

      ⊘No Sigma rule has matched

      Snort Signatures

      ⊘No Snort rule has matched

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Multi AV Scanner detection for submitted file
      Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeVirustotal: Detection: 32%Perma Link
      Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
      Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
      Source: Binary string: f:\bluetooth8.0.1.57\sw\src\WIN8_Mainline\ExtArch\UI\Win7UI\Prism\Composite.UnityExtensions\obj\x64\Release\Microsoft.Practices.Composite.UnityExtensions.pdb source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000000.00000003.248079149.0000000002891000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Practices.Composite.UnityExtensions.dll.0.dr
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 0_2_00405FFD FindFirstFileA,FindClose,0_2_00405FFD
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 0_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,0_2_0040559B
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 0_2_00402688 FindFirstFileA,0_2_00402688
      Source: application-x-executable.png.0.drString found in binary or memory: http://creativecommons.org/licenses/by-sa/4.0/
      Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000000.00000003.248538306.0000000002890000.00000004.00000020.00020000.00000000.sdmp, default.css.0.drString found in binary or memory: http://mozilla.org/MPL/2.0/.
      Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeString found in binary or memory: http://nsis.sf.net/NSIS_Error
      Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
      Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000000.00000003.248538306.0000000002890000.00000004.00000020.00020000.00000000.sdmp, default.css.0.drString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 0_2_00405050 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_00405050
      Source: Conhost.exeProcess created: 87
      Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
      Source: Microsoft.Practices.Composite.UnityExtensions.dll.0.drStatic PE information: No import functions for PE file found
      Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000000.00000003.248079149.0000000002891000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Practices.Composite.UnityExtensions.dll\ vs Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeSection loaded: havegangenes.dllJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 0_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004030D9
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: C:\Windows\resources\0409Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 0_2_004063440_2_00406344
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 0_2_0040488F0_2_0040488F
      Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeStatic PE information: invalid certificate
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess Stats: CPU usage > 98%
      Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeVirustotal: Detection: 32%
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile read: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeJump to behavior
      Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: unknownProcess created: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x19^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x05^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x07^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x78^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x79^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x08^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2A^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3F^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0D^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x27^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0A^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x63^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x26^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7F^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x73^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7F^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x19^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x05^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x07^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x78^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x79^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x08^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2A^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3F^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0D^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x27^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0A^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x63^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x26^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7F^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x73^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0D^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x27^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0A^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x73^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2A^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7F^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x79^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x79^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x79^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 0_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004030D9
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: C:\Users\user\PacifisterneJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: C:\Users\user\AppData\Local\Temp\nswCDB0.tmpJump to behavior
      Source: classification engineClassification label: mal64.troj.evad.winEXE@410/8@0/0
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 0_2_0040205E CoCreateInstance,MultiByteToWideChar,0_2_0040205E
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile read: C:\Users\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 0_2_0040431C GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,0_2_0040431C
      Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
      Source: Binary string: f:\bluetooth8.0.1.57\sw\src\WIN8_Mainline\ExtArch\UI\Win7UI\Prism\Composite.UnityExtensions\obj\x64\Release\Microsoft.Practices.Composite.UnityExtensions.pdb source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000000.00000003.248079149.0000000002891000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Practices.Composite.UnityExtensions.dll.0.dr

      Data Obfuscation

      barindex
      Yara detected GuLoader
      Source: Yara matchFile source: 00000000.00000002.514197554.0000000000613000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe PID: 6056, type: MEMORYSTR
      Obfuscated command line found
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x19^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x05^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x07^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x78^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x79^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x08^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2A^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3F^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0D^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x27^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0A^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x63^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x26^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7F^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x73^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7F^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x19^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x05^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x07^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x78^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x79^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x08^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2A^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3F^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0D^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x27^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0A^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x63^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x26^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7F^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x73^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0D^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x27^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0A^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x73^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2A^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7F^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x79^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x79^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x79^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 0_2_10002D20 push eax; ret 0_2_10002D4E
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,0_2_10001A5D
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: C:\Users\user\Pacifisterne\Automatcafeer\Nedrustningspolitikken\Dilemmaers146\Glasgaibleanir\Nodebilledet\Microsoft.Practices.Composite.UnityExtensions.dllJump to dropped file
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dllJump to dropped file
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\nsExec.dllJump to dropped file
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess information set: NOOPENFILEERRORBOXJump to behavior

      Malware Analysis System Evasion

      barindex
      Mass process execution to delay analysis
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x19^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x05^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x07^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x78^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x79^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x08^75"
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeDropped PE file which has not been started: C:\Users\user\Pacifisterne\Automatcafeer\Nedrustningspolitikken\Dilemmaers146\Glasgaibleanir\Nodebilledet\Microsoft.Practices.Composite.UnityExtensions.dllJump to dropped file
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 0_2_00405FFD FindFirstFileA,FindClose,0_2_00405FFD
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 0_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,0_2_0040559B
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 0_2_00402688 FindFirstFileA,0_2_00402688
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeAPI call chain: ExitProcess graph end nodegraph_0-4755
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeAPI call chain: ExitProcess graph end nodegraph_0-4763
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,0_2_10001A5D
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x19^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x05^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x07^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x78^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x79^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x08^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2A^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3F^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0D^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x27^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0A^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x63^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x26^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7F^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x73^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0D^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x27^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0A^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x73^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2A^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7F^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x79^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x79^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x79^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 0_2_00405D1B GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,0_2_00405D1B

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid Accounts1
      Command and Scripting Interpreter      		1
      DLL Side-Loading      		1
      Access Token Manipulation      		11
      Masquerading      		OS Credential Dumping1
      Time Based Evasion      		Remote Services1
      Archive Collected Data      		Exfiltration Over Other Network Medium1
      Encrypted Channel      		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
      System Shutdown/Reboot
      Default Accounts1
      Native API      		Boot or Logon Initialization Scripts11
      Process Injection      		1
      Access Token Manipulation      		LSASS Memory2
      File and Directory Discovery      		Remote Desktop Protocol1
      Clipboard Data      		Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)1
      DLL Side-Loading      		11
      Process Injection      		Security Account Manager3
      System Information Discovery      		SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)1
      Deobfuscate/Decode Files or Information      		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
      Time Based Evasion      		LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
      Replication Through Removable MediaLaunchdRc.commonRc.common1
      Obfuscated Files or Information      		Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
      External Remote ServicesScheduled TaskStartup ItemsStartup Items1
      DLL Side-Loading      		DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet
      behaviorgraph top1 signatures2 2 Behavior Graph ID: 791299 Sample: Pilne zamowienie nr5363582 ... Startdate: 25/01/2023 Architecture: WINDOWS Score: 64 39 Multi AV Scanner detection for submitted file 2->39 41 Yara detected GuLoader 2->41 43 Obfuscated command line found 2->43 45 Mass process execution to delay analysis 2->45 7 Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe 1 34 2->7         started        process3 file4 33 Microsoft.Practice...UnityExtensions.dll, PE32+ 7->33 dropped 35 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 7->35 dropped 37 C:\Users\user\AppData\Local\...\System.dll, PE32 7->37 dropped 47 Obfuscated command line found 7->47 11 cmd.exe 7->11         started        13 cmd.exe 7->13         started        15 cmd.exe 7->15         started        17 61 other processes 7->17 signatures5 process6 process7 19 Conhost.exe 11->19         started        21 Conhost.exe 13->21         started        23 Conhost.exe 15->23         started        25 Conhost.exe 17->25         started        27 Conhost.exe 17->27         started        29 Conhost.exe 17->29         started        31 58 other processes 17->31

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe10%ReversingLabs
      Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe33%VirustotalBrowse

      Dropped Files

      SourceDetectionScannerLabelLink
      C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll1%VirustotalBrowse
      C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\nsExec.dll2%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\nsExec.dll1%VirustotalBrowse
      C:\Users\user\Pacifisterne\Automatcafeer\Nedrustningspolitikken\Dilemmaers146\Glasgaibleanir\Nodebilledet\Microsoft.Practices.Composite.UnityExtensions.dll0%ReversingLabs
      C:\Users\user\Pacifisterne\Automatcafeer\Nedrustningspolitikken\Dilemmaers146\Glasgaibleanir\Nodebilledet\Microsoft.Practices.Composite.UnityExtensions.dll0%VirustotalBrowse

      Unpacked PE Files

      SourceDetectionScannerLabelLinkDownload
      0.2.Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe.400000.0.unpack100%AviraHEUR/AGEN.1223491Download File
      0.0.Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe.400000.0.unpack100%AviraHEUR/AGEN.1223491Download File

      Domains

      ⊘No Antivirus matches

      URLs

      ⊘No Antivirus matches

      Domains and IPs

      Contacted Domains

      ⊘No contacted domains info

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      http://www.apache.org/licenses/LICENSE-2.0Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000000.00000003.248538306.0000000002890000.00000004.00000020.00020000.00000000.sdmp, default.css.0.drfalse
        		high
        http://creativecommons.org/licenses/by-sa/4.0/application-x-executable.png.0.drfalse
          		high
          http://nsis.sf.net/NSIS_ErrorPilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exefalse
            		high
            http://nsis.sf.net/NSIS_ErrorErrorPilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exefalse
              		high
              http://mozilla.org/MPL/2.0/.Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000000.00000003.248538306.0000000002890000.00000004.00000020.00020000.00000000.sdmp, default.css.0.drfalse
                		high

                World Map of Contacted IPs

                ⊘No contacted IP infos

                General Information

                Joe Sandbox Version:36.0.0 Rainbow Opal
                Analysis ID:791299
                Start date and time:2023-01-25 09:52:49 +01:00
                Joe Sandbox Product:CloudBasic
                Overall analysis duration:0h 8m 20s
                Hypervisor based Inspection enabled:false
                Report type:full
                Sample file name:Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                Cookbook file name:default.jbs
                Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                Number of analysed new started processes analysed:161
                Number of new started drivers analysed:0
                Number of existing processes analysed:0
                Number of existing drivers analysed:0
                Number of injected processes analysed:0
                Technologies:
                • HCA enabled
                • EGA enabled
                • HDC enabled
                • AMSI enabled
                Analysis Mode:default
                Analysis stop reason:Timeout
                Detection:MAL
                Classification:mal64.troj.evad.winEXE@410/8@0/0
                EGA Information:
                • Successful, ratio: 100%
                HDC Information:
                • Successful, ratio: 63% (good quality ratio 61.6%)
                • Quality average: 88.6%
                • Quality standard deviation: 21.8%
                HCA Information:
                • Successful, ratio: 99%
                • Number of executed functions: 56
                • Number of non-executed functions: 29
                Cookbook Comments:
                • Found application associated with file extension: .exe

                Warnings

                • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                • Excluded IPs from analysis (whitelisted): 13.107.5.88, 13.107.42.16, 40.126.31.69, 20.190.159.23, 20.190.159.2, 20.190.159.0, 20.190.159.68, 20.190.159.4, 40.126.31.67, 20.190.159.73, 131.253.33.200, 13.107.22.200
                • Excluded domains from analysis (whitelisted): ocos-office365-s2s.msedge.net, client-office365-tas.msedge.net, config.edge.skype.com.trafficmanager.net, eudb.ris.api.iris.microsoft.com, e-0009.e-msedge.net, arc.msn.com, prda.aadg.msidentity.com, config-edge-skype.l-0007.l-msedge.net, login.live.com, www-bing-com.dual-a-0001.a-msedge.net, img-prod-cms-rt-microsoft-com.akamaized.net, cdn.onenote.net, l-0007.l-msedge.net, config.edge.skype.com, storeedgefd.dsx.mp.microsoft.com, www.bing.com, fs.microsoft.com, afdo-tas-offload.trafficmanager.net, ctldl.windowsupdate.com, www.tm.a.prd.aadg.akadns.net, www-www.bing.com.trafficmanager.net, login.msa.msidentity.com, ris.api.iris.microsoft.com, ocos-office365-s2s-msedge-net.e-0009.e-msedge.net, dual-a-0001.dc-msedge.net, store-images.s-microsoft.com, l-0007.config.skype.com, www.tm.lg.prod.aadmsa.trafficmanager.net
                • Not all processes where analyzed, report is missing behavior information
                • Report size getting too big, too many NtWriteVirtualMemory calls found.

                Simulations

                Behavior and APIs

                TimeTypeDescription
                09:53:43API Interceptor1x Sleep call for process: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe modified

                Joe Sandbox View / Context

                IPs

                ⊘No context

                Domains

                ⊘No context

                ASNs

                ⊘No context

                JA3 Fingerprints

                ⊘No context

                Dropped Files

                MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dllinq 0394511 JPG.exeGet hashmaliciousBrowse
                  inq 0394511 JPG.exeGet hashmaliciousBrowse
                    Purchase order 3812_xls_.exe.exeGet hashmaliciousBrowse
                      Purchase order 3812_xls_.exe.exeGet hashmaliciousBrowse
                        Purchase order 3812_xls_.exe.exeGet hashmaliciousBrowse
                          Purchase order 3812_xls_.exe.exeGet hashmaliciousBrowse
                            Purchase order 3812_xls_.exe.exeGet hashmaliciousBrowse
                              Scan_Doc.docx.exeGet hashmaliciousBrowse
                                Scan_Doc.docx.exeGet hashmaliciousBrowse
                                  KoRdtkxn6c.exeGet hashmaliciousBrowse
                                    KoRdtkxn6c.exeGet hashmaliciousBrowse
                                      Jjfmcz1Hsz.exeGet hashmaliciousBrowse
                                        Jjfmcz1Hsz.exeGet hashmaliciousBrowse
                                          PmRXFyOFkf.exeGet hashmaliciousBrowse
                                            PmRXFyOFkf.exeGet hashmaliciousBrowse
                                              Lakeringernes (1).exeGet hashmaliciousBrowse
                                                Lakeringernes (1).exeGet hashmaliciousBrowse
                                                  proforma.exeGet hashmaliciousBrowse
                                                    proforma.exeGet hashmaliciousBrowse
                                                      factura pdf.exeGet hashmaliciousBrowse

                                                        Created / dropped Files

                                                        C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                        Category:dropped
                                                        Size (bytes):11264
                                                        Entropy (8bit):5.770803561213006
                                                        Encrypted:false
                                                        SSDEEP:192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
                                                        MD5:2AE993A2FFEC0C137EB51C8832691BCB
                                                        SHA1:98E0B37B7C14890F8A599F35678AF5E9435906E1
                                                        SHA-256:681382F3134DE5C6272A49DD13651C8C201B89C247B471191496E7335702FA59
                                                        SHA-512:2501371EB09C01746119305BA080F3B8C41E64535FF09CEE4F51322530366D0BD5322EA5290A466356598027E6CDA8AB360CAEF62DCAF560D630742E2DD9BCD9
                                                        Malicious:false
                                                        Antivirus:
                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                        • Antivirus: Virustotal, Detection: 1%, Browse
                                                        Joe Sandbox View:
                                                        • Filename: inq 0394511 JPG.exe, Detection: malicious, Browse
                                                        • Filename: inq 0394511 JPG.exe, Detection: malicious, Browse
                                                        • Filename: Purchase order 3812_xls_.exe.exe, Detection: malicious, Browse
                                                        • Filename: Purchase order 3812_xls_.exe.exe, Detection: malicious, Browse
                                                        • Filename: Purchase order 3812_xls_.exe.exe, Detection: malicious, Browse
                                                        • Filename: Purchase order 3812_xls_.exe.exe, Detection: malicious, Browse
                                                        • Filename: Purchase order 3812_xls_.exe.exe, Detection: malicious, Browse
                                                        • Filename: Scan_Doc.docx.exe, Detection: malicious, Browse
                                                        • Filename: Scan_Doc.docx.exe, Detection: malicious, Browse
                                                        • Filename: KoRdtkxn6c.exe, Detection: malicious, Browse
                                                        • Filename: KoRdtkxn6c.exe, Detection: malicious, Browse
                                                        • Filename: Jjfmcz1Hsz.exe, Detection: malicious, Browse
                                                        • Filename: Jjfmcz1Hsz.exe, Detection: malicious, Browse
                                                        • Filename: PmRXFyOFkf.exe, Detection: malicious, Browse
                                                        • Filename: PmRXFyOFkf.exe, Detection: malicious, Browse
                                                        • Filename: Lakeringernes (1).exe, Detection: malicious, Browse
                                                        • Filename: Lakeringernes (1).exe, Detection: malicious, Browse
                                                        • Filename: proforma.exe, Detection: malicious, Browse
                                                        • Filename: proforma.exe, Detection: malicious, Browse
                                                        • Filename: factura pdf.exe, Detection: malicious, Browse
                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L...tc.W...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...O........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..`....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                        C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\nsExec.dll

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                        Category:dropped
                                                        Size (bytes):6656
                                                        Entropy (8bit):4.994861218233575
                                                        Encrypted:false
                                                        SSDEEP:96:U7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNN3e:mXhHR0aTQN4gRHdMqJVgNE
                                                        MD5:B648C78981C02C434D6A04D4422A6198
                                                        SHA1:74D99EED1EAE76C7F43454C01CDB7030E5772FC2
                                                        SHA-256:3E3D516D4F28948A474704D5DC9907DBE39E3B3F98E7299F536337278C59C5C9
                                                        SHA-512:219C88C0EF9FD6E3BE34C56D8458443E695BADD27861D74C486143306A94B8318E6593BF4DA81421E88E4539B238557DD4FE1F5BEDF3ECEC59727917099E90D2
                                                        Malicious:false
                                                        Antivirus:
                                                        • Antivirus: ReversingLabs, Detection: 2%
                                                        • Antivirus: Virustotal, Detection: 1%, Browse
                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........d..7..7..7..7..7,..7..7..7..7..7..7Rich..7........PE..L...rc.W...........!......................... ...............................P.......................................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..,.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

                                                        C:\Users\user\Pacifisterne\Automatcafeer\Nedrustningspolitikken\Dilemmaers146\Glasgaibleanir\Nodebilledet\Microsoft.Practices.Composite.UnityExtensions.dll

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                        File Type:PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
                                                        Category:dropped
                                                        Size (bytes):18048
                                                        Entropy (8bit):5.781710632242959
                                                        Encrypted:false
                                                        SSDEEP:384:PDNDRvozv1hgXptjLrzs4AvgWOMrq0eMDI/:ZRvA4r77ARg/
                                                        MD5:270209B12F7C117C539F574CE2576C0A
                                                        SHA1:184B447F6364FA0760F862B84CBC6E717C9F5C3D
                                                        SHA-256:C5DB3358A184147D6FFB41F05BBF9BA9356038A0867A783F266EA62813EF6CF4
                                                        SHA-512:BB062EF832EB2B477D92FDF71C0B6B30AA590A735DEC1920400C3DA74EC07FF1F1DBF9E50E63EE2FDD68E9E48FC39F5522DFF0A029E47658A41F88EEC9FD250A
                                                        Malicious:false
                                                        Antivirus:
                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                        • Antivirus: Virustotal, Detection: 0%, Browse
                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...W..S.........." .....0............... .....@..... ....................................@...@......@............... ...............................`...............8..............dM............................................................... ..H............text...6.... ...0.................. ..`.rsrc........`.......2..............@..@.reloc...............8..............@..BH........*..\#..........`&........................................................{....*"..}....*..{....*"..(....*...0............}.....o......-.(....s....z.r...p..o......o....(.....(....-.(....s....z.r3..p..o.....(....o...+&.o.....r_..p..o.....o....&.o....&.o.....r...p..o.....o......,...(....o...+(....(.....r...p..o.....o.....r...p..o....*..(...(....(.....+...(....(.....,...(....(....*2.(....o...+*...0..%..........(.....o....o...+&.o......,..(.....o...+&.{....9......-...(.........(.

                                                        C:\Users\user\Pacifisterne\Automatcafeer\Nedrustningspolitikken\Dilemmaers146\Glasgaibleanir\Nodebilledet\Reinspired.Aut

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                        File Type:ASCII text, with very long lines (50244), with no line terminators
                                                        Category:dropped
                                                        Size (bytes):50244
                                                        Entropy (8bit):3.999625167208849
                                                        Encrypted:false
                                                        SSDEEP:768:4Kt0hO4obUZX9nvBHp7RJ+CqqSK0haV6RTFA9yu7m1HK0TWgKL383w6gW:81oq9nvjqqSiUu9yu7m1HzT4L38AhW
                                                        MD5:21337BAB1F65E60A88523B4DDB961E52
                                                        SHA1:AD9C448F53AB48C3110D25650BACFE44C1988D51
                                                        SHA-256:E2565D3B49D70ACDAD0AB4162BA0FBF738F227A0EC224982A813E874C46C0FCE
                                                        SHA-512:A6DAE16844C6A433AFF4EDE77F0E77984073CEC0E38D439B57144670EE0F4034BD5F2FFCB6647010F6717A7F39928A6F04E7F05BA9511745F38CF6A49891FFDA
                                                        Malicious:false
                                                        Preview:56E3E082070CC707B0B701B836A6FEDCB0D7E6E50989CF2DA81B4311EF928EBF02F09C7EB977BC9031BA864CC44F17929BE2524D78FC507F411DCBC91BE502D51D27CA45924DFC91765F6EB7845C91C0D665E583A8AD0203D0E4E6E6CD17355A6BEE2CB460D8FEE6D05422DDF5EE3A100E5B5DF7E16AF5EE06574C03F45CF5AB392237D86BD7BA856648AFC8934A58C5CB26436F55DDADFBBF10B9B4879334CB8EC34E3188C13AB624B5BD476E64AE8E29F5D01B1F4990A3C97BFCFF07D4B1C9164FF864EC64F66817B8CB32DEDF9FCDD8BFEA77F0E8FA2FF734E9693AB8DB0E567BF76D363F5446629BF43E8658F94A657CA3A4E1F8CBE2A0DF2079A857E95B935916B09270CBD505DC004B5398C830A48C5BEC0BF51F45B3CF8B5BB54C379E941830FBE112B9AA311E3DDCB33515B088213DF149B237AA4C2FDEF37D6456FA22C12527A4B8369506B1AD0523F47A8479C3F96173652E3E9D10BC37BBDA514166816FEB43067D30B2F3AF7514968878341027AC20B0A426E2E7C25DCBA0B6FED381151DDA1B09092FF33782B8325E6B87234F9652F4DB96B3783CDA3D515E98CEDAACDBA19D8B6F8900215829145E262A081177B80AA3834EDBFF2F96C95ED77E31546A6F59C87BE0A467B5CF31606F7D2E6453A34C7B7AF3DAFCFB71E6B5770C2B1BC25C472C3653338393230C4F9FFB4398AD

                                                        C:\Users\user\Pacifisterne\Automatcafeer\Seacross.Him

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):285823
                                                        Entropy (8bit):7.384888860358361
                                                        Encrypted:false
                                                        SSDEEP:3072:RPwTCrZk0BdcUdJ9bh2df3UvT1q3olHbVfvco8uKbtfEqL42V9oCWRtTT5sEgZOF:hTe00ykdvUvT1XGcofEmopbtlXF
                                                        MD5:6CD4A3E95E9C6BA051D63C5177522F4B
                                                        SHA1:38CBCD09C46F8637421F4D604C9C634A755D7EB0
                                                        SHA-256:98BBC8D8E0B70E12F3A2C541CA197D27FFBC4B25BEDB517E0C510A20F0EEAC17
                                                        SHA-512:E23F984A19945EB3A0595F5AB74D9C7D5EFDDC03B12CB376AAC4FF301B614619C7DB625387DCB8F9339F1F0EB148C329652FF9303FD053A74618E51CF8232116
                                                        Malicious:false
                                                        Preview:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

                                                        C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne\default.css

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                        File Type:Unicode text, UTF-8 text
                                                        Category:dropped
                                                        Size (bytes):19729
                                                        Entropy (8bit):4.854870578875106
                                                        Encrypted:false
                                                        SSDEEP:384:SfWIec2c8Fn9khSO774VZE+HDxYADgab6YDrvCEE5c:SfWpc8Fn9khSO3yZE+HFYADJv/E5c
                                                        MD5:A9006B652EBD39E033121BBAD1D45AC9
                                                        SHA1:A9A681BD5801984388334C85B8E09561A21913FF
                                                        SHA-256:E84FAFC9058C23AD27C2BE6BB8ED9CAC9AAC1744376330D53D7D531C1EA3EABE
                                                        SHA-512:0B2F899C1FB7030F5ACA15E4F23F250CC62D5014ECBAE0E5CE738F9172895AB82C2B93693F3A078EC3642B3549355E25DA16834A9714CCF8B33087ED3BACAF1B
                                                        Malicious:false
                                                        Preview:/*. * This file is part of the LibreOffice project.. *. * This Source Code Form is subject to the terms of the Mozilla Public. * License, v. 2.0. If a copy of the MPL was not distributed with this. * file, You can obtain one at http://mozilla.org/MPL/2.0/.. *. * This file incorporates work covered by the following license notice:. *. * Licensed to the Apache Software Foundation (ASF) under one or more. * contributor license agreements. See the NOTICE file distributed. * with this work for additional information regarding copyright. * ownership. The ASF licenses this file to you under the Apache. * License, Version 2.0 (the "License"); you may not use this file. * except in compliance with the License. You may obtain a copy of. * the License at http://www.apache.org/licenses/LICENSE-2.0 .. */./*.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++.+ LIBREOFFICE HELP IN BROWSER +.+ DEFAULT STYLE

                                                        C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne\network-cellular-signal-none-symbolic.svg

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                        File Type:SVG Scalable Vector Graphics image
                                                        Category:dropped
                                                        Size (bytes):660
                                                        Entropy (8bit):4.929915592008811
                                                        Encrypted:false
                                                        SSDEEP:12:t4CDqaZnoUJgiCydrkeYRAerAFFLAmLRHGdK5D9DME:t4C9ZoUJyyKbRAecFxfRHGMRtME
                                                        MD5:96756F6658DD20BCB387DECC6C2FB720
                                                        SHA1:42E06BBF711B5F71D07B965A0654AFF6249B99D6
                                                        SHA-256:C15238E9B65995BDADC206340B33E7B7E50EF00031F5B61DF9700BBB5350F635
                                                        SHA-512:F64F1B4C96611ADF276F87F242501534DA8D9D2A17A00749A4FE05DE051DA5CAEDF545D39D574BB7E6447CC272C5F9BF2E8B0EE88B277EDDB46D1E263C08FA1B
                                                        Malicious:false
                                                        Preview:<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"><path d="M8 4v11h3V4zm4-3v14h3V1zM4 7v8h3V7zm-4 3v5h3v-5z" style="line-height:normal;font-variant-ligatures:normal;font-variant-position:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-alternates:normal;font-feature-settings:normal;text-indent:0;text-align:start;text-decoration-line:none;text-decoration-style:solid;text-decoration-color:#000;text-transform:none;text-orientation:mixed;shape-padding:0;isolation:auto;mix-blend-mode:normal" overflow="visible" opacity=".35" color="#000" font-weight="400" font-family="sans-serif" fill="#474747" fill-rule="evenodd"/></svg>

                                                        C:\Users\user\Pacifisterne\Automatcafeer\Tubulating\application-x-executable.png

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                        File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                        Category:dropped
                                                        Size (bytes):981
                                                        Entropy (8bit):7.490445024712213
                                                        Encrypted:false
                                                        SSDEEP:24:Xtk15wEzJDA4IttcJtoyV+i2FgT17uiW1cWhncisE:XtkHj2t2HoyQxgJY/bsE
                                                        MD5:57788EB5F2415CF88CDDF86A995B497F
                                                        SHA1:CDF8E6B6E0F823C6A77EA66569B61BE5D760BF96
                                                        SHA-256:08F67C366FB7F3371CA2E3B65DA0A4F9AEBD57D18A2990CB7571A8C2ECAD5D41
                                                        SHA-512:024EF704154FC9D0DC38679F1C017691A69E5282E58297F018C40C5957C409B74CFE5F70ACB6BF35CDE8631265366F4E987DF80C1D2E57639253D1CE6FCD5B68
                                                        Malicious:false
                                                        Preview:.PNG........IHDR................a....sBIT....|.d.....pHYs..........+......tEXtSoftware.www.inkscape.org..<.....tEXtTitle.Adwaita Icon Template...?....tEXtAuthor.GNOME Design Team`.v~...RtEXtCopyright.CC Attribution-ShareAlike http://creativecommons.org/licenses/by-sa/4.0/.Tb.....IDAT8...KHTa....w_s.<n3..dY..ZH.hW.ET+.R.....,.ha.hQ...m-J..,.....0(j.0.Ef..L.c53w.w.|-"m|.Y......p....9..0....2.r.{...t..G- ..hU%oU.B26..R.(j../.k.>.....*.(.e..b[nNE#....Q..?......'...Nj.x..h.....!'..Zsu......0p7.....+&..Q.a.;A)..l(.QU^".O.7............m/c..D....@. H..V.P...Qy.uJ.]...S[..z).x..\..G...I6.tn"N.`.YP.PP....0..1...v....f..>N\.o..Z.....r..yw.. ..@.H..1W.....7.2fP0V..&..h.........T...9=.L:..D7...H..........`....39d...z*...[..........8...u.........X..1$..p6.G..`...}'.)..}'o.|.Ttb(-..xAD......D....T>.n..Nw..A...w...!-2....N.....U....Hhq.._$..i.~v.k.!.@b.oH....E&vj.).f.t...8^.{Sy=s1.{.._f./$G...5....x..........@...O[..........`.NB@e.o......t.....V..`U....IEND.B`.

                                                        Static File Info

                                                        General

                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                        Entropy (8bit):6.874744026790643
                                                        TrID:
                                                        • Win32 Executable (generic) a (10002005/4) 99.96%
                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                        • DOS Executable Generic (2002/1) 0.02%
                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                        File name:Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                        File size:669600
                                                        MD5:17388d36388d280c4e2d724c9ab58002
                                                        SHA1:ee660100dfbad59a2796244514bff64c66cd0ca7
                                                        SHA256:5f20a33e263b8b8f5388b8e2512d0678312257b8fdf592b8a83aa481076048ca
                                                        SHA512:b49d055149f26ce72cd04ecd6fd581523fdeaf7f3234e8b547fa0fedbaf52aae6b408480c4cebdb7359422d9ae7664dcd8a083d99f13d9fbc1692d4914895ce4
                                                        SSDEEP:12288:Pkvld8NVtfkug41IDHQ215k5P5x2/dKRy6i5y:PeHiMrQ2HkLI/ki5y
                                                        TLSH:40E4F6527059808AE8A738F3685FC07014A02EAD92EDD25E66F67B2645F2313CC5FF9D
                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F.*.....F...G.v.F.*.....F...v...F...@...F.Rich..F.........................PE..L....c.W.................^.........

                                                        File Icon

                                                        Icon Hash:3319396623190917

                                                        Static PE Info

                                                        General

                                                        Entrypoint:0x4030d9
                                                        Entrypoint Section:.text
                                                        Digitally signed:true
                                                        Imagebase:0x400000
                                                        Subsystem:windows gui
                                                        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                        Time Stamp:0x5795638D [Mon Jul 25 00:55:41 2016 UTC]
                                                        TLS Callbacks:
                                                        CLR (.Net) Version:
                                                        OS Version Major:4
                                                        OS Version Minor:0
                                                        File Version Major:4
                                                        File Version Minor:0
                                                        Subsystem Version Major:4
                                                        Subsystem Version Minor:0
                                                        Import Hash:b78ecf47c0a3e24a6f4af114e2d1f5de

                                                        Authenticode Signature

                                                        Signature Valid:false
                                                        Signature Issuer:CN=Dictatorialism, OU="Innervational Chloropal Stald ", E=Covalency@Bedrveligheds.Sl, O=Dictatorialism, L=Tarrant Rushton, S=England, C=GB
                                                        Signature Validation Error:A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
                                                        Error Number:-2146762487
                                                        Not Before, Not After
                                                        • 1/24/2023 12:31:02 AM 1/23/2026 12:31:02 AM
                                                        Subject Chain
                                                        • CN=Dictatorialism, OU="Innervational Chloropal Stald ", E=Covalency@Bedrveligheds.Sl, O=Dictatorialism, L=Tarrant Rushton, S=England, C=GB
                                                        Version:3
                                                        Thumbprint MD5:7F1F45BD7FCC95B4458C5EC8BFA17430
                                                        Thumbprint SHA-1:31BE90317316BB6D5DBEDE711C3E03BCD2EF533A
                                                        Thumbprint SHA-256:801CB0CF2041D9240AC71DE2FCEEC2FA0C23383EF6BEA436ECE5CCF3C1CB066D
                                                        Serial:E5205A57DA732B09

                                                        Entrypoint Preview

                                                        Instruction
                                                        sub esp, 00000184h
                                                        push ebx
                                                        push esi
                                                        push edi
                                                        xor ebx, ebx
                                                        push 00008001h
                                                        mov dword ptr [esp+18h], ebx
                                                        mov dword ptr [esp+10h], 00409198h
                                                        mov dword ptr [esp+20h], ebx
                                                        mov byte ptr [esp+14h], 00000020h
                                                        call dword ptr [004070A8h]
                                                        call dword ptr [004070A4h]
                                                        cmp ax, 00000006h
                                                        je 00007FF410ED2933h
                                                        push ebx
                                                        call 00007FF410ED58A1h
                                                        cmp eax, ebx
                                                        je 00007FF410ED2929h
                                                        push 00000C00h
                                                        call eax
                                                        mov esi, 00407298h
                                                        push esi
                                                        call 00007FF410ED581Dh
                                                        push esi
                                                        call dword ptr [004070A0h]
                                                        lea esi, dword ptr [esi+eax+01h]
                                                        cmp byte ptr [esi], bl
                                                        jne 00007FF410ED290Dh
                                                        push ebp
                                                        push 00000009h
                                                        call 00007FF410ED5874h
                                                        push 00000007h
                                                        call 00007FF410ED586Dh
                                                        mov dword ptr [00423704h], eax
                                                        call dword ptr [00407044h]
                                                        push ebx
                                                        call dword ptr [00407288h]
                                                        mov dword ptr [004237B8h], eax
                                                        push ebx
                                                        lea eax, dword ptr [esp+38h]
                                                        push 00000160h
                                                        push eax
                                                        push ebx
                                                        push 0041ECC8h
                                                        call dword ptr [00407174h]
                                                        push 00409188h
                                                        push 00422F00h
                                                        call 00007FF410ED5497h
                                                        call dword ptr [0040709Ch]
                                                        mov ebp, 00429000h
                                                        push eax
                                                        push ebp
                                                        call 00007FF410ED5485h
                                                        push ebx
                                                        call dword ptr [00407154h]

                                                        Rich Headers

                                                        Programming Language:
                                                        • [EXP] VC++ 6.0 SP5 build 8804

                                                        Data Directories

                                                        NameVirtual AddressVirtual Size Is in Section
                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x74280xa0.rdata
                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x3e0000x5aec8.rsrc
                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0xa30780x728
                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IAT0x70000x298.rdata
                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                        Sections

                                                        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                        .text0x10000x5c5b0x5e00False0.6603640292553191data6.411456379497882IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                        .rdata0x70000x12460x1400False0.42734375data5.005029341587408IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                        .data0x90000x1a7f80x400False0.6376953125data5.108396988130901IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                        .ndata0x240000x1a0000x0False0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                        .rsrc0x3e0000x5aec80x5b000False0.23903245192307693data5.402063687419607IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                        Resources

                                                        NameRVASizeTypeLanguageCountry
                                                        RT_ICON0x3e2b00x42028Device independent bitmap graphic, 256 x 512 x 32, image size 270336EnglishUnited States
                                                        RT_ICON0x802d80x10828Device independent bitmap graphic, 128 x 256 x 32, image size 67584EnglishUnited States
                                                        RT_ICON0x90b000x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896EnglishUnited States
                                                        RT_ICON0x94d280x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States
                                                        RT_ICON0x972d00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States
                                                        RT_ICON0x983780x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States
                                                        RT_DIALOG0x987e00x100dataEnglishUnited States
                                                        RT_DIALOG0x988e00x11cdataEnglishUnited States
                                                        RT_DIALOG0x98a000xc4dataEnglishUnited States
                                                        RT_DIALOG0x98ac80x60dataEnglishUnited States
                                                        RT_GROUP_ICON0x98b280x5adataEnglishUnited States
                                                        RT_MANIFEST0x98b880x33dXML 1.0 document, ASCII text, with very long lines (829), with no line terminatorsEnglishUnited States

                                                        Imports

                                                        DLLImport
                                                        KERNEL32.dllSetEnvironmentVariableA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, GetFileAttributesA, SetFileAttributesA, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, ExitProcess, GetFullPathNameA, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, CloseHandle, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, lstrcmpiA, SetFileTime, lstrcmpA, ExpandEnvironmentStringsA, GlobalUnlock, GetDiskFreeSpaceA, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
                                                        USER32.dllScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
                                                        GDI32.dllSelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                        SHELL32.dllSHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
                                                        ADVAPI32.dllRegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
                                                        COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                        ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

                                                        Possible Origin

                                                        Language of compilation systemCountry where language is spokenMap
                                                        EnglishUnited States

                                                        Network Behavior

                                                        ⊘No network behavior found

                                                        Statistics

                                                        CPU Usage

                                                        Click to jump to process

                                                        Memory Usage

                                                        Click to jump to process

                                                        High Level Behavior Distribution

                                                        Click to dive into process behavior distribution

                                                        Behavior

                                                        Click to jump to process

                                                        System Behavior

                                                        General

                                                        Target ID:0
                                                        Start time:09:53:42
                                                        Start date:25/01/2023
                                                        Path:C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                        Wow64 process (32bit):true
                                                        Commandline:C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                        Imagebase:0x400000
                                                        File size:669600 bytes
                                                        MD5 hash:17388D36388D280C4E2D724C9AB58002
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Yara matches:
                                                        • Rule: JoeSecurity_GuLoader_3, Description: Yara detected GuLoader, Source: 00000000.00000002.514197554.0000000000613000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                        Reputation:low

                                                        General

                                                        Target ID:1
                                                        Start time:09:53:44
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x0E^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high

                                                        General

                                                        Target ID:2
                                                        Start time:09:53:44
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high

                                                        General

                                                        Target ID:3
                                                        Start time:09:53:44
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x19^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high

                                                        General

                                                        Target ID:4
                                                        Start time:09:53:44
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high

                                                        General

                                                        Target ID:5
                                                        Start time:09:53:44
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x05^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high

                                                        General

                                                        Target ID:6
                                                        Start time:09:53:44
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high

                                                        General

                                                        Target ID:7
                                                        Start time:09:53:44
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x0E^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high

                                                        General

                                                        Target ID:8
                                                        Start time:09:53:44
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high

                                                        General

                                                        Target ID:9
                                                        Start time:09:53:44
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x07^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:10
                                                        Start time:09:53:44
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:11
                                                        Start time:09:53:44
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x78^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:12
                                                        Start time:09:53:44
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:13
                                                        Start time:09:53:44
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x79^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:14
                                                        Start time:09:53:45
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:15
                                                        Start time:09:53:45
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x71^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:16
                                                        Start time:09:53:45
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:17
                                                        Start time:09:53:45
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x71^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:18
                                                        Start time:09:53:45
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:19
                                                        Start time:09:53:45
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x08^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:20
                                                        Start time:09:53:45
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:21
                                                        Start time:09:53:45
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x39^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:22
                                                        Start time:09:53:45
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:23
                                                        Start time:09:53:45
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x2E^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:24
                                                        Start time:09:53:45
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:25
                                                        Start time:09:53:45
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x2A^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:26
                                                        Start time:09:53:45
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:27
                                                        Start time:09:53:45
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x3F^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:28
                                                        Start time:09:53:45
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:29
                                                        Start time:09:53:46
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x2E^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:30
                                                        Start time:09:53:46
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:31
                                                        Start time:09:53:46
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x0D^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:32
                                                        Start time:09:53:46
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:33
                                                        Start time:09:53:46
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x22^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:34
                                                        Start time:09:53:46
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:35
                                                        Start time:09:53:46
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x27^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:36
                                                        Start time:09:53:46
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:37
                                                        Start time:09:53:46
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x2E^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:38
                                                        Start time:09:53:46
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:39
                                                        Start time:09:53:46
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x0A^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:40
                                                        Start time:09:53:46
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:41
                                                        Start time:09:53:46
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x63^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:42
                                                        Start time:09:53:46
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:43
                                                        Start time:09:53:47
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x26^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:44
                                                        Start time:09:53:47
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:0x7ff745070000
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:45
                                                        Start time:09:53:47
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x6B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:46
                                                        Start time:09:53:47
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:47
                                                        Start time:09:53:47
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x39^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:48
                                                        Start time:09:53:47
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:49
                                                        Start time:09:53:47
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x7F^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:50
                                                        Start time:09:53:47
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:51
                                                        Start time:09:53:47
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x6B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:52
                                                        Start time:09:53:47
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:53
                                                        Start time:09:53:47
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x67^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:54
                                                        Start time:09:53:47
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:55
                                                        Start time:09:53:47
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x6B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:56
                                                        Start time:09:53:47
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:57
                                                        Start time:09:53:47
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x22^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:58
                                                        Start time:09:53:48
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:59
                                                        Start time:09:53:48
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x6B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:60
                                                        Start time:09:53:48
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:61
                                                        Start time:09:53:48
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x7B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:62
                                                        Start time:09:53:48
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:63
                                                        Start time:09:53:48
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x33^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:64
                                                        Start time:09:53:48
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:65
                                                        Start time:09:53:48
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x73^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:66
                                                        Start time:09:53:48
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:67
                                                        Start time:09:53:48
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x7B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:68
                                                        Start time:09:53:48
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:69
                                                        Start time:09:53:48
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x7B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:70
                                                        Start time:09:53:48
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:71
                                                        Start time:09:53:48
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x7B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:72
                                                        Start time:09:53:48
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:73
                                                        Start time:09:53:49
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x7B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:74
                                                        Start time:09:53:49
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:75
                                                        Start time:09:53:49
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x7B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:76
                                                        Start time:09:53:49
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:77
                                                        Start time:09:53:49
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x7B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:78
                                                        Start time:09:53:49
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:79
                                                        Start time:09:53:49
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x7B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:80
                                                        Start time:09:53:49
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:81
                                                        Start time:09:53:49
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x67^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:82
                                                        Start time:09:53:49
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:83
                                                        Start time:09:53:49
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x6B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:84
                                                        Start time:09:53:49
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:85
                                                        Start time:09:53:49
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x22^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:86
                                                        Start time:09:53:49
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:87
                                                        Start time:09:53:50
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x6B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:88
                                                        Start time:09:53:50
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:89
                                                        Start time:09:53:50
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x7B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:90
                                                        Start time:09:53:50
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:91
                                                        Start time:09:53:50
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x67^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:92
                                                        Start time:09:53:50
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:93
                                                        Start time:09:53:50
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x6B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:94
                                                        Start time:09:53:50
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:95
                                                        Start time:09:53:50
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x3B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:96
                                                        Start time:09:53:50
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:97
                                                        Start time:09:53:50
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x6B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:98
                                                        Start time:09:53:50
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:99
                                                        Start time:09:53:50
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x7B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:100
                                                        Start time:09:53:50
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:101
                                                        Start time:09:53:50
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x67^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:102
                                                        Start time:09:53:50
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:103
                                                        Start time:09:53:51
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x6B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:104
                                                        Start time:09:53:51
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:105
                                                        Start time:09:53:51
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x22^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:106
                                                        Start time:09:53:51
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:107
                                                        Start time:09:53:51
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x6B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:108
                                                        Start time:09:53:51
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:109
                                                        Start time:09:53:51
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x7F^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:110
                                                        Start time:09:53:51
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:111
                                                        Start time:09:53:51
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x67^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:112
                                                        Start time:09:53:51
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:113
                                                        Start time:09:53:51
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x6B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:114
                                                        Start time:09:53:51
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:115
                                                        Start time:09:53:51
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x22^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:116
                                                        Start time:09:53:51
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:117
                                                        Start time:09:53:52
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x6B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:118
                                                        Start time:09:53:52
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:119
                                                        Start time:09:53:52
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x7B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:120
                                                        Start time:09:53:52
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:121
                                                        Start time:09:53:52
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x33^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:122
                                                        Start time:09:53:52
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:123
                                                        Start time:09:53:52
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x73^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:124
                                                        Start time:09:53:52
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:125
                                                        Start time:09:53:52
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x7B^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:126
                                                        Start time:09:53:52
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:127
                                                        Start time:09:53:52
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):
                                                        Commandline:cmd.exe /c set /A "0x67^75"
                                                        Imagebase:
                                                        File size:232960 bytes
                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        General

                                                        Target ID:128
                                                        Start time:09:53:52
                                                        Start date:25/01/2023
                                                        Path:C:\Windows\System32\Conhost.exe
                                                        Wow64 process (32bit):
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:
                                                        Has administrator privileges:
                                                        Programmed in:C, C++ or other language

                                                        Disassembly

                                                        Reset < >

                                                          Execution Graph

                                                          Execution Coverage:20.1%
                                                          Dynamic/Decrypted Code Coverage:14.1%
                                                          Signature Coverage:21.6%
                                                          Total number of Nodes:1506
                                                          Total number of Limit Nodes:43
                                                          execution_graph 4964 10001000 4967 1000101b 4964->4967 4974 100014bb 4967->4974 4969 10001020 4970 10001024 4969->4970 4971 10001027 GlobalAlloc 4969->4971 4972 100014e2 3 API calls 4970->4972 4971->4970 4973 10001019 4972->4973 4975 100014c1 4974->4975 4976 100014c7 4975->4976 4977 100014d3 GlobalFree 4975->4977 4976->4969 4977->4969 4978 4027c1 4979 402a1d 18 API calls 4978->4979 4980 4027c7 4979->4980 4981 402802 4980->4981 4982 4027eb 4980->4982 4989 4026a6 4980->4989 4985 402818 4981->4985 4986 40280c 4981->4986 4983 4027f0 4982->4983 4984 4027ff 4982->4984 4992 405cf9 lstrcpynA 4983->4992 4984->4989 4993 405c57 wsprintfA 4984->4993 4988 405d1b 18 API calls 4985->4988 4987 402a1d 18 API calls 4986->4987 4987->4984 4988->4984 4992->4989 4993->4989 4994 401cc2 4995 402a1d 18 API calls 4994->4995 4996 401cd2 SetWindowLongA 4995->4996 4997 4028cf 4996->4997 4998 401a43 4999 402a1d 18 API calls 4998->4999 5000 401a49 4999->5000 5001 402a1d 18 API calls 5000->5001 5002 4019f3 5001->5002 3993 401e44 3994 402a3a 18 API calls 3993->3994 3995 401e4a 3994->3995 4009 404f12 3995->4009 3999 401eb0 CloseHandle 4001 4026a6 3999->4001 4000 401e5a 4000->3999 4000->4001 4002 401e79 WaitForSingleObject 4000->4002 4023 4060ce 4000->4023 4002->4000 4003 401e87 GetExitCodeProcess 4002->4003 4004 401ea4 4003->4004 4005 401e99 4003->4005 4004->3999 4008 401ea2 4004->4008 4027 405c57 wsprintfA 4005->4027 4008->3999 4010 404f2d 4009->4010 4018 401e54 4009->4018 4011 404f4a lstrlenA 4010->4011 4014 405d1b 18 API calls 4010->4014 4012 404f73 4011->4012 4013 404f58 lstrlenA 4011->4013 4016 404f86 4012->4016 4017 404f79 SetWindowTextA 4012->4017 4015 404f6a lstrcatA 4013->4015 4013->4018 4014->4011 4015->4012 4016->4018 4019 404f8c SendMessageA SendMessageA SendMessageA 4016->4019 4017->4016 4020 40548a CreateProcessA 4018->4020 4019->4018 4021 4054c9 4020->4021 4022 4054bd CloseHandle 4020->4022 4021->4000 4022->4021 4024 4060eb PeekMessageA 4023->4024 4025 4060e1 DispatchMessageA 4024->4025 4026 4060fb 4024->4026 4025->4024 4026->4002 4027->4008 5003 402644 5004 40264a 5003->5004 5005 402652 FindClose 5004->5005 5006 4028cf 5004->5006 5005->5006 5007 406344 5011 4061c8 5007->5011 5008 406b33 5009 406252 GlobalAlloc 5009->5008 5009->5011 5010 406249 GlobalFree 5010->5009 5011->5008 5011->5009 5011->5010 5012 4062c0 GlobalFree 5011->5012 5013 4062c9 GlobalAlloc 5011->5013 5012->5013 5013->5008 5013->5011 5014 4026c6 5015 402a3a 18 API calls 5014->5015 5016 4026d4 5015->5016 5017 4026ea 5016->5017 5018 402a3a 18 API calls 5016->5018 5019 405947 2 API calls 5017->5019 5018->5017 5020 4026f0 5019->5020 5042 40596c GetFileAttributesA CreateFileA 5020->5042 5022 4026fd 5023 4027a0 5022->5023 5024 402709 GlobalAlloc 5022->5024 5027 4027a8 DeleteFileA 5023->5027 5028 4027bb 5023->5028 5025 402722 5024->5025 5026 402797 CloseHandle 5024->5026 5043 403091 SetFilePointer 5025->5043 5026->5023 5027->5028 5030 402728 5031 40307b ReadFile 5030->5031 5032 402731 GlobalAlloc 5031->5032 5033 402741 5032->5033 5034 402775 5032->5034 5036 402e9f 36 API calls 5033->5036 5035 405a13 WriteFile 5034->5035 5037 402781 GlobalFree 5035->5037 5041 40274e 5036->5041 5038 402e9f 36 API calls 5037->5038 5040 402794 5038->5040 5039 40276c GlobalFree 5039->5034 5040->5026 5041->5039 5042->5022 5043->5030 5044 402847 5045 402a1d 18 API calls 5044->5045 5046 40284d 5045->5046 5047 40287e 5046->5047 5049 4026a6 5046->5049 5050 40285b 5046->5050 5048 405d1b 18 API calls 5047->5048 5047->5049 5048->5049 5050->5049 5052 405c57 wsprintfA 5050->5052 5052->5049 5053 4022c7 5054 402a3a 18 API calls 5053->5054 5055 4022d8 5054->5055 5056 402a3a 18 API calls 5055->5056 5057 4022e1 5056->5057 5058 402a3a 18 API calls 5057->5058 5059 4022eb GetPrivateProfileStringA 5058->5059 4242 1000270b 4243 1000275b 4242->4243 4244 1000271b VirtualProtect 4242->4244 4244->4243 5063 1000180d 5064 10001830 5063->5064 5065 10001860 GlobalFree 5064->5065 5066 10001872 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z __allrem 5064->5066 5065->5066 5067 10001266 2 API calls 5066->5067 5068 100019e3 GlobalFree GlobalFree 5067->5068 4348 405050 4349 405072 GetDlgItem GetDlgItem GetDlgItem 4348->4349 4350 4051fb 4348->4350 4394 403f13 SendMessageA 4349->4394 4351 405203 GetDlgItem CreateThread FindCloseChangeNotification 4350->4351 4354 40522b 4350->4354 4351->4354 4397 404fe4 OleInitialize 4351->4397 4353 405259 4358 405261 4353->4358 4359 4052b4 4353->4359 4354->4353 4356 405241 ShowWindow ShowWindow 4354->4356 4357 40527a 4354->4357 4355 4050e2 4360 4050e9 GetClientRect GetSystemMetrics SendMessageA SendMessageA 4355->4360 4396 403f13 SendMessageA 4356->4396 4364 403f45 8 API calls 4357->4364 4362 405269 4358->4362 4363 40528d ShowWindow 4358->4363 4359->4357 4367 4052c1 SendMessageA 4359->4367 4365 405157 4360->4365 4366 40513b SendMessageA SendMessageA 4360->4366 4368 403eb7 SendMessageA 4362->4368 4370 4052ad 4363->4370 4371 40529f 4363->4371 4369 405286 4364->4369 4373 40516a 4365->4373 4374 40515c SendMessageA 4365->4374 4366->4365 4367->4369 4375 4052da CreatePopupMenu 4367->4375 4368->4357 4372 403eb7 SendMessageA 4370->4372 4376 404f12 25 API calls 4371->4376 4372->4359 4378 403ede 19 API calls 4373->4378 4374->4373 4377 405d1b 18 API calls 4375->4377 4376->4370 4379 4052ea AppendMenuA 4377->4379 4380 40517a 4378->4380 4381 405308 GetWindowRect 4379->4381 4382 40531b TrackPopupMenu 4379->4382 4383 405183 ShowWindow 4380->4383 4384 4051b7 GetDlgItem SendMessageA 4380->4384 4381->4382 4382->4369 4385 405337 4382->4385 4386 4051a6 4383->4386 4387 405199 ShowWindow 4383->4387 4384->4369 4388 4051de SendMessageA SendMessageA 4384->4388 4389 405356 SendMessageA 4385->4389 4395 403f13 SendMessageA 4386->4395 4387->4386 4388->4369 4389->4389 4390 405373 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 4389->4390 4392 405395 SendMessageA 4390->4392 4392->4392 4393 4053b7 GlobalUnlock SetClipboardData CloseClipboard 4392->4393 4393->4369 4394->4355 4395->4384 4396->4353 4398 403f2a SendMessageA 4397->4398 4399 405007 4398->4399 4402 401389 2 API calls 4399->4402 4403 40502e 4399->4403 4400 403f2a SendMessageA 4401 405040 OleUninitialize 4400->4401 4402->4399 4403->4400 4598 401751 4599 402a3a 18 API calls 4598->4599 4600 401758 4599->4600 4601 401776 4600->4601 4602 40177e 4600->4602 4637 405cf9 lstrcpynA 4601->4637 4638 405cf9 lstrcpynA 4602->4638 4605 40177c 4609 405f64 5 API calls 4605->4609 4606 401789 4607 40576b 3 API calls 4606->4607 4608 40178f lstrcatA 4607->4608 4608->4605 4622 40179b 4609->4622 4610 405ffd 2 API calls 4610->4622 4611 405947 2 API calls 4611->4622 4613 4017b2 CompareFileTime 4613->4622 4614 401876 4615 404f12 25 API calls 4614->4615 4616 401880 4615->4616 4619 402e9f 36 API calls 4616->4619 4617 404f12 25 API calls 4635 401862 4617->4635 4618 405cf9 lstrcpynA 4618->4622 4620 401893 4619->4620 4621 4018a7 SetFileTime 4620->4621 4624 4018b9 FindCloseChangeNotification 4620->4624 4621->4624 4622->4610 4622->4611 4622->4613 4622->4614 4622->4618 4623 405d1b 18 API calls 4622->4623 4633 40184d 4622->4633 4636 40596c GetFileAttributesA CreateFileA 4622->4636 4639 4054ef 4622->4639 4623->4622 4625 4018ca 4624->4625 4624->4635 4626 4018e2 4625->4626 4627 4018cf 4625->4627 4629 405d1b 18 API calls 4626->4629 4628 405d1b 18 API calls 4627->4628 4631 4018d7 lstrcatA 4628->4631 4632 4018ea 4629->4632 4631->4632 4634 4054ef MessageBoxIndirectA 4632->4634 4633->4617 4633->4635 4634->4635 4636->4622 4637->4605 4638->4606 4640 405504 4639->4640 4641 405550 4640->4641 4642 405518 MessageBoxIndirectA 4640->4642 4641->4622 4642->4641 5076 401651 5077 402a3a 18 API calls 5076->5077 5078 401657 5077->5078 5079 405ffd 2 API calls 5078->5079 5080 40165d 5079->5080 5081 401951 5082 402a1d 18 API calls 5081->5082 5083 401958 5082->5083 5084 402a1d 18 API calls 5083->5084 5085 401962 5084->5085 5086 402a3a 18 API calls 5085->5086 5087 40196b 5086->5087 5088 40197e lstrlenA 5087->5088 5092 4019b9 5087->5092 5089 401988 5088->5089 5089->5092 5094 405cf9 lstrcpynA 5089->5094 5091 4019a2 5091->5092 5093 4019af lstrlenA 5091->5093 5093->5092 5094->5091 4643 4021d2 4644 402a3a 18 API calls 4643->4644 4645 4021d8 4644->4645 4646 402a3a 18 API calls 4645->4646 4647 4021e1 4646->4647 4648 402a3a 18 API calls 4647->4648 4649 4021ea 4648->4649 4650 405ffd 2 API calls 4649->4650 4651 4021f3 4650->4651 4652 402204 lstrlenA lstrlenA 4651->4652 4653 4021f7 4651->4653 4655 404f12 25 API calls 4652->4655 4654 404f12 25 API calls 4653->4654 4657 4021ff 4653->4657 4654->4657 4656 402240 SHFileOperationA 4655->4656 4656->4653 4656->4657 5095 4019d2 5096 402a3a 18 API calls 5095->5096 5097 4019d9 5096->5097 5098 402a3a 18 API calls 5097->5098 5099 4019e2 5098->5099 5100 4019e9 lstrcmpiA 5099->5100 5101 4019fb lstrcmpA 5099->5101 5102 4019ef 5100->5102 5101->5102 5103 402254 5104 40225b 5103->5104 5107 40226e 5103->5107 5105 405d1b 18 API calls 5104->5105 5106 402268 5105->5106 5108 4054ef MessageBoxIndirectA 5106->5108 5108->5107 5109 4042d5 5110 4042e5 5109->5110 5111 40430b 5109->5111 5112 403ede 19 API calls 5110->5112 5113 403f45 8 API calls 5111->5113 5114 4042f2 SetDlgItemTextA 5112->5114 5115 404317 5113->5115 5114->5111 4693 4014d6 4694 402a1d 18 API calls 4693->4694 4695 4014dc Sleep 4694->4695 4697 4028cf 4695->4697 4711 4030d9 SetErrorMode GetVersion 4712 403110 4711->4712 4713 403116 4711->4713 4714 406092 5 API calls 4712->4714 4715 406024 3 API calls 4713->4715 4714->4713 4716 40312c lstrlenA 4715->4716 4716->4713 4717 40313b 4716->4717 4718 406092 5 API calls 4717->4718 4719 403143 4718->4719 4720 406092 5 API calls 4719->4720 4721 40314a #17 OleInitialize SHGetFileInfoA 4720->4721 4799 405cf9 lstrcpynA 4721->4799 4723 403187 GetCommandLineA 4800 405cf9 lstrcpynA 4723->4800 4725 403199 GetModuleHandleA 4726 4031b0 4725->4726 4727 405796 CharNextA 4726->4727 4728 4031c4 CharNextA 4727->4728 4734 4031d4 4728->4734 4729 40329e 4730 4032b1 GetTempPathA 4729->4730 4801 4030a8 4730->4801 4732 4032c9 4735 403323 DeleteFileA 4732->4735 4736 4032cd GetWindowsDirectoryA lstrcatA 4732->4736 4733 405796 CharNextA 4733->4734 4734->4729 4734->4733 4740 4032a0 4734->4740 4811 402c66 GetTickCount GetModuleFileNameA 4735->4811 4738 4030a8 12 API calls 4736->4738 4739 4032e9 4738->4739 4739->4735 4742 4032ed GetTempPathA lstrcatA SetEnvironmentVariableA SetEnvironmentVariableA 4739->4742 4895 405cf9 lstrcpynA 4740->4895 4741 403337 4743 4033cd 4741->4743 4746 4033bd 4741->4746 4750 405796 CharNextA 4741->4750 4745 4030a8 12 API calls 4742->4745 4898 40359f 4743->4898 4748 40331b 4745->4748 4839 403679 4746->4839 4748->4735 4748->4743 4752 403352 4750->4752 4761 403398 4752->4761 4762 4033fd 4752->4762 4753 403505 4755 403587 ExitProcess 4753->4755 4756 40350d GetCurrentProcess OpenProcessToken 4753->4756 4754 4033e7 4757 4054ef MessageBoxIndirectA 4754->4757 4758 403558 4756->4758 4759 403528 LookupPrivilegeValueA AdjustTokenPrivileges 4756->4759 4763 4033f5 ExitProcess 4757->4763 4766 406092 5 API calls 4758->4766 4759->4758 4764 405859 18 API calls 4761->4764 4765 405472 5 API calls 4762->4765 4767 4033a3 4764->4767 4768 403402 lstrcatA 4765->4768 4769 40355f 4766->4769 4767->4743 4896 405cf9 lstrcpynA 4767->4896 4770 403413 lstrcatA 4768->4770 4771 40341e lstrcatA lstrcmpiA 4768->4771 4772 403574 ExitWindowsEx 4769->4772 4775 403580 4769->4775 4770->4771 4771->4743 4774 40343a 4771->4774 4772->4755 4772->4775 4777 403446 4774->4777 4778 40343f 4774->4778 4779 40140b 2 API calls 4775->4779 4776 4033b2 4897 405cf9 lstrcpynA 4776->4897 4782 405455 2 API calls 4777->4782 4781 4053d8 4 API calls 4778->4781 4779->4755 4783 403444 4781->4783 4784 40344b SetCurrentDirectoryA 4782->4784 4783->4784 4785 403465 4784->4785 4786 40345a 4784->4786 4906 405cf9 lstrcpynA 4785->4906 4905 405cf9 lstrcpynA 4786->4905 4789 405d1b 18 API calls 4790 4034a4 DeleteFileA 4789->4790 4791 4034b1 CopyFileA 4790->4791 4796 403473 4790->4796 4791->4796 4792 4034f9 4794 405bb4 38 API calls 4792->4794 4793 405bb4 38 API calls 4793->4796 4794->4743 4795 405d1b 18 API calls 4795->4796 4796->4789 4796->4792 4796->4793 4796->4795 4797 40548a 2 API calls 4796->4797 4798 4034e5 CloseHandle 4796->4798 4797->4796 4798->4796 4799->4723 4800->4725 4802 405f64 5 API calls 4801->4802 4803 4030b4 4802->4803 4804 4030be 4803->4804 4805 40576b 3 API calls 4803->4805 4804->4732 4806 4030c6 4805->4806 4807 405455 2 API calls 4806->4807 4808 4030cc 4807->4808 4907 40599b 4808->4907 4911 40596c GetFileAttributesA CreateFileA 4811->4911 4813 402ca6 4831 402cb6 4813->4831 4912 405cf9 lstrcpynA 4813->4912 4815 402ccc 4816 4057b2 2 API calls 4815->4816 4817 402cd2 4816->4817 4913 405cf9 lstrcpynA 4817->4913 4819 402cdd GetFileSize 4824 402cf4 4819->4824 4836 402dd9 4819->4836 4821 402de2 4823 402e12 GlobalAlloc 4821->4823 4821->4831 4926 403091 SetFilePointer 4821->4926 4822 40307b ReadFile 4822->4824 4925 403091 SetFilePointer 4823->4925 4824->4822 4826 402e45 4824->4826 4824->4831 4835 402c02 6 API calls 4824->4835 4824->4836 4830 402c02 6 API calls 4826->4830 4828 402dfb 4832 40307b ReadFile 4828->4832 4829 402e2d 4833 402e9f 36 API calls 4829->4833 4830->4831 4831->4741 4834 402e06 4832->4834 4837 402e39 4833->4837 4834->4823 4834->4831 4835->4824 4914 402c02 4836->4914 4837->4831 4837->4837 4838 402e76 SetFilePointer 4837->4838 4838->4831 4840 406092 5 API calls 4839->4840 4841 40368d 4840->4841 4842 403693 GetUserDefaultUILanguage 4841->4842 4843 4036a5 4841->4843 4927 405c57 wsprintfA 4842->4927 4845 405be0 3 API calls 4843->4845 4847 4036d0 4845->4847 4846 4036a3 4928 40393e 4846->4928 4848 4036ee lstrcatA 4847->4848 4849 405be0 3 API calls 4847->4849 4848->4846 4849->4848 4852 405859 18 API calls 4853 403720 4852->4853 4854 4037a9 4853->4854 4856 405be0 3 API calls 4853->4856 4855 405859 18 API calls 4854->4855 4857 4037af 4855->4857 4858 40374c 4856->4858 4859 4037bf LoadImageA 4857->4859 4860 405d1b 18 API calls 4857->4860 4858->4854 4863 403768 lstrlenA 4858->4863 4866 405796 CharNextA 4858->4866 4861 403865 4859->4861 4862 4037e6 RegisterClassA 4859->4862 4860->4859 4865 40140b 2 API calls 4861->4865 4864 40381c SystemParametersInfoA CreateWindowExA 4862->4864 4894 40386f 4862->4894 4867 403776 lstrcmpiA 4863->4867 4868 40379c 4863->4868 4864->4861 4869 40386b 4865->4869 4871 403766 4866->4871 4867->4868 4872 403786 GetFileAttributesA 4867->4872 4870 40576b 3 API calls 4868->4870 4873 40393e 19 API calls 4869->4873 4869->4894 4874 4037a2 4870->4874 4871->4863 4875 403792 4872->4875 4876 40387c 4873->4876 4937 405cf9 lstrcpynA 4874->4937 4875->4868 4878 4057b2 2 API calls 4875->4878 4879 403888 ShowWindow 4876->4879 4880 40390b 4876->4880 4878->4868 4881 406024 3 API calls 4879->4881 4882 404fe4 5 API calls 4880->4882 4884 4038a0 4881->4884 4883 403911 4882->4883 4885 403915 4883->4885 4886 40392d 4883->4886 4887 4038ae GetClassInfoA 4884->4887 4889 406024 3 API calls 4884->4889 4892 40140b 2 API calls 4885->4892 4885->4894 4888 40140b 2 API calls 4886->4888 4890 4038c2 GetClassInfoA RegisterClassA 4887->4890 4891 4038d8 DialogBoxParamA 4887->4891 4888->4894 4889->4887 4890->4891 4893 40140b 2 API calls 4891->4893 4892->4894 4893->4894 4894->4743 4895->4730 4896->4776 4897->4746 4899 4035b7 4898->4899 4900 4035a9 CloseHandle 4898->4900 4939 4035e4 4899->4939 4900->4899 4903 40559b 69 API calls 4904 4033d6 OleUninitialize 4903->4904 4904->4753 4904->4754 4905->4785 4906->4796 4908 4059a6 GetTickCount GetTempFileNameA 4907->4908 4909 4030d7 4908->4909 4910 4059d3 4908->4910 4909->4732 4910->4908 4910->4909 4911->4813 4912->4815 4913->4819 4915 402c23 4914->4915 4916 402c0b 4914->4916 4919 402c33 GetTickCount 4915->4919 4920 402c2b 4915->4920 4917 402c14 DestroyWindow 4916->4917 4918 402c1b 4916->4918 4917->4918 4918->4821 4922 402c41 CreateDialogParamA ShowWindow 4919->4922 4923 402c64 4919->4923 4921 4060ce 2 API calls 4920->4921 4924 402c31 4921->4924 4922->4923 4923->4821 4924->4821 4925->4829 4926->4828 4927->4846 4929 403952 4928->4929 4938 405c57 wsprintfA 4929->4938 4931 4039c3 4932 405d1b 18 API calls 4931->4932 4933 4039cf SetWindowTextA 4932->4933 4934 4036fe 4933->4934 4935 4039eb 4933->4935 4934->4852 4935->4934 4936 405d1b 18 API calls 4935->4936 4936->4935 4937->4854 4938->4931 4941 4035f2 4939->4941 4940 4035bc 4940->4903 4941->4940 4942 4035f7 FreeLibrary GlobalFree 4941->4942 4942->4940 4942->4942 5116 1000161a 5117 10001649 5116->5117 5118 10001a5d 18 API calls 5117->5118 5119 10001650 5118->5119 5120 10001663 5119->5120 5121 10001657 5119->5121 5123 1000168a 5120->5123 5124 1000166d 5120->5124 5122 10001266 2 API calls 5121->5122 5125 10001661 5122->5125 5127 10001690 5123->5127 5128 100016b4 5123->5128 5126 100014e2 3 API calls 5124->5126 5130 10001672 5126->5130 5131 10001559 3 API calls 5127->5131 5129 100014e2 3 API calls 5128->5129 5129->5125 5132 10001559 3 API calls 5130->5132 5133 10001695 5131->5133 5135 10001678 5132->5135 5134 10001266 2 API calls 5133->5134 5136 1000169b GlobalFree 5134->5136 5137 10001266 2 API calls 5135->5137 5136->5125 5138 100016af GlobalFree 5136->5138 5139 1000167e GlobalFree 5137->5139 5138->5125 5139->5125 4943 40155b 4944 401577 ShowWindow 4943->4944 4945 40157e 4943->4945 4944->4945 4946 40158c ShowWindow 4945->4946 4947 4028cf 4945->4947 4946->4947 4948 40255c 4949 402a1d 18 API calls 4948->4949 4952 402566 4949->4952 4950 4025d0 4951 4059e4 ReadFile 4951->4952 4952->4950 4952->4951 4953 4025d2 4952->4953 4954 4025e2 4952->4954 4957 405c57 wsprintfA 4953->4957 4954->4950 4956 4025f8 SetFilePointer 4954->4956 4956->4950 4957->4950 5140 40205e 5141 402a3a 18 API calls 5140->5141 5142 402065 5141->5142 5143 402a3a 18 API calls 5142->5143 5144 40206f 5143->5144 5145 402a3a 18 API calls 5144->5145 5146 402079 5145->5146 5147 402a3a 18 API calls 5146->5147 5148 402083 5147->5148 5149 402a3a 18 API calls 5148->5149 5150 40208d 5149->5150 5151 4020cc CoCreateInstance 5150->5151 5152 402a3a 18 API calls 5150->5152 5155 4020eb 5151->5155 5157 402193 5151->5157 5152->5151 5153 401423 25 API calls 5154 4021c9 5153->5154 5156 402173 MultiByteToWideChar 5155->5156 5155->5157 5156->5157 5157->5153 5157->5154 5158 40265e 5159 402664 5158->5159 5160 402668 FindNextFileA 5159->5160 5163 40267a 5159->5163 5161 4026b9 5160->5161 5160->5163 5164 405cf9 lstrcpynA 5161->5164 5164->5163 5165 401cde GetDlgItem GetClientRect 5166 402a3a 18 API calls 5165->5166 5167 401d0e LoadImageA SendMessageA 5166->5167 5168 401d2c DeleteObject 5167->5168 5169 4028cf 5167->5169 5168->5169 5170 401662 5171 402a3a 18 API calls 5170->5171 5172 401669 5171->5172 5173 402a3a 18 API calls 5172->5173 5174 401672 5173->5174 5175 402a3a 18 API calls 5174->5175 5176 40167b MoveFileA 5175->5176 5177 401687 5176->5177 5178 40168e 5176->5178 5179 401423 25 API calls 5177->5179 5180 405ffd 2 API calls 5178->5180 5182 4021c9 5178->5182 5179->5182 5181 40169d 5180->5181 5181->5182 5183 405bb4 38 API calls 5181->5183 5183->5177 4028 402364 4029 40236a 4028->4029 4030 402a3a 18 API calls 4029->4030 4031 40237c 4030->4031 4032 402a3a 18 API calls 4031->4032 4033 402386 RegCreateKeyExA 4032->4033 4034 4023b0 4033->4034 4044 4026a6 4033->4044 4035 4023c8 4034->4035 4036 402a3a 18 API calls 4034->4036 4037 402a1d 18 API calls 4035->4037 4038 4023d4 4035->4038 4040 4023c1 lstrlenA 4036->4040 4037->4038 4039 4023ef RegSetValueExA 4038->4039 4045 402e9f 4038->4045 4042 402405 RegCloseKey 4039->4042 4040->4035 4042->4044 4047 402eb5 4045->4047 4046 402ee0 4066 40307b 4046->4066 4047->4046 4078 403091 SetFilePointer 4047->4078 4051 40301b 4053 40301f 4051->4053 4057 403037 4051->4057 4052 402efd GetTickCount 4064 402f10 4052->4064 4055 40307b ReadFile 4053->4055 4054 403005 4054->4039 4055->4054 4056 40307b ReadFile 4056->4057 4057->4054 4057->4056 4059 405a13 WriteFile 4057->4059 4058 40307b ReadFile 4058->4064 4059->4057 4061 402f76 GetTickCount 4061->4064 4062 402f9f MulDiv wsprintfA 4063 404f12 25 API calls 4062->4063 4063->4064 4064->4054 4064->4058 4064->4061 4064->4062 4069 406195 4064->4069 4076 405a13 WriteFile 4064->4076 4079 4059e4 ReadFile 4066->4079 4070 4061ba 4069->4070 4073 4061c2 4069->4073 4070->4064 4071 406252 GlobalAlloc 4071->4070 4071->4073 4072 406249 GlobalFree 4072->4071 4073->4070 4073->4071 4073->4072 4074 4062c0 GlobalFree 4073->4074 4075 4062c9 GlobalAlloc 4073->4075 4074->4075 4075->4070 4075->4073 4077 405a31 4076->4077 4077->4064 4078->4046 4080 402eeb 4079->4080 4080->4051 4080->4052 4080->4054 5191 401dea 5192 402a3a 18 API calls 5191->5192 5193 401df0 5192->5193 5194 402a3a 18 API calls 5193->5194 5195 401df9 5194->5195 5196 402a3a 18 API calls 5195->5196 5197 401e02 5196->5197 5198 402a3a 18 API calls 5197->5198 5199 401e0b 5198->5199 5200 401423 25 API calls 5199->5200 5201 401e12 ShellExecuteA 5200->5201 5202 401e3f 5201->5202 5203 40466d 5204 404699 5203->5204 5205 40467d 5203->5205 5206 4046cc 5204->5206 5207 40469f SHGetPathFromIDListA 5204->5207 5214 4054d3 GetDlgItemTextA 5205->5214 5210 4046b6 SendMessageA 5207->5210 5211 4046af 5207->5211 5209 40468a SendMessageA 5209->5204 5210->5206 5212 40140b 2 API calls 5211->5212 5212->5210 5214->5209 5215 401eee 5216 402a3a 18 API calls 5215->5216 5217 401ef5 5216->5217 5218 406092 5 API calls 5217->5218 5219 401f04 5218->5219 5220 401f1c GlobalAlloc 5219->5220 5229 401f84 5219->5229 5221 401f30 5220->5221 5220->5229 5222 406092 5 API calls 5221->5222 5223 401f37 5222->5223 5224 406092 5 API calls 5223->5224 5225 401f41 5224->5225 5225->5229 5230 405c57 wsprintfA 5225->5230 5227 401f78 5231 405c57 wsprintfA 5227->5231 5230->5227 5231->5229 5232 4014f0 SetForegroundWindow 5233 4028cf 5232->5233 5234 403ff2 lstrcpynA lstrlenA 5235 100015b3 5236 100014bb GlobalFree 5235->5236 5238 100015cb 5236->5238 5237 10001611 GlobalFree 5238->5237 5239 100015e6 5238->5239 5240 100015fd VirtualFree 5238->5240 5239->5237 5240->5237 5246 4018f5 5247 40192c 5246->5247 5248 402a3a 18 API calls 5247->5248 5249 401931 5248->5249 5250 40559b 69 API calls 5249->5250 5251 40193a 5250->5251 5252 4024f7 5253 402a3a 18 API calls 5252->5253 5254 4024fe 5253->5254 5257 40596c GetFileAttributesA CreateFileA 5254->5257 5256 40250a 5257->5256 5258 4018f8 5259 402a3a 18 API calls 5258->5259 5260 4018ff 5259->5260 5261 4054ef MessageBoxIndirectA 5260->5261 5262 401908 5261->5262 5277 1000103d 5278 1000101b 5 API calls 5277->5278 5279 10001056 5278->5279 5280 4014fe 5281 401506 5280->5281 5283 401519 5280->5283 5282 402a1d 18 API calls 5281->5282 5282->5283 5284 402b7f 5285 402b8e SetTimer 5284->5285 5286 402ba7 5284->5286 5285->5286 5287 402bfc 5286->5287 5288 402bc1 MulDiv wsprintfA SetWindowTextA SetDlgItemTextA 5286->5288 5288->5287 5289 401000 5290 401037 BeginPaint GetClientRect 5289->5290 5291 40100c DefWindowProcA 5289->5291 5293 4010f3 5290->5293 5294 401179 5291->5294 5295 401073 CreateBrushIndirect FillRect DeleteObject 5293->5295 5296 4010fc 5293->5296 5295->5293 5297 401102 CreateFontIndirectA 5296->5297 5298 401167 EndPaint 5296->5298 5297->5298 5299 401112 6 API calls 5297->5299 5298->5294 5299->5298 3920 402482 3931 402b44 3920->3931 3922 40248c 3935 402a1d 3922->3935 3924 402495 3925 40249f 3924->3925 3928 4026a6 3924->3928 3926 4024b8 RegEnumValueA 3925->3926 3927 4024ac RegEnumKeyA 3925->3927 3926->3928 3929 4024d1 RegCloseKey 3926->3929 3927->3929 3929->3928 3938 402a3a 3931->3938 3933 402b5d 3934 402b6b RegOpenKeyExA 3933->3934 3934->3922 3936 405d1b 18 API calls 3935->3936 3937 402a31 3936->3937 3937->3924 3939 402a46 3938->3939 3944 405d1b 3939->3944 3942 402a73 3942->3933 3957 405d28 3944->3957 3945 402a67 3945->3942 3962 405f64 3945->3962 3946 405f4b 3946->3945 3978 405cf9 lstrcpynA 3946->3978 3948 405dc9 GetVersion 3948->3957 3949 405f22 lstrlenA 3949->3957 3952 405d1b 10 API calls 3952->3949 3953 405e41 GetSystemDirectoryA 3953->3957 3955 405e54 GetWindowsDirectoryA 3955->3957 3956 405f64 5 API calls 3956->3957 3957->3946 3957->3948 3957->3949 3957->3952 3957->3953 3957->3955 3957->3956 3958 405e88 SHGetSpecialFolderLocation 3957->3958 3959 405d1b 10 API calls 3957->3959 3960 405ecb lstrcatA 3957->3960 3971 405be0 RegOpenKeyExA 3957->3971 3976 405c57 wsprintfA 3957->3976 3977 405cf9 lstrcpynA 3957->3977 3958->3957 3961 405ea0 SHGetPathFromIDListA CoTaskMemFree 3958->3961 3959->3957 3960->3957 3961->3957 3968 405f70 3962->3968 3963 405fdc CharPrevA 3964 405fd8 3963->3964 3964->3963 3966 405ff7 3964->3966 3965 405fcd CharNextA 3965->3964 3965->3968 3966->3942 3968->3964 3968->3965 3969 405fbb CharNextA 3968->3969 3970 405fc8 CharNextA 3968->3970 3979 405796 3968->3979 3969->3968 3970->3965 3972 405c51 3971->3972 3973 405c13 RegQueryValueExA 3971->3973 3972->3957 3974 405c34 RegCloseKey 3973->3974 3974->3972 3976->3957 3977->3957 3978->3945 3980 40579c 3979->3980 3981 4057af 3980->3981 3982 4057a2 CharNextA 3980->3982 3981->3968 3982->3980 5307 401b02 5308 402a3a 18 API calls 5307->5308 5309 401b09 5308->5309 5310 402a1d 18 API calls 5309->5310 5311 401b12 wsprintfA 5310->5311 5312 4028cf 5311->5312 3983 402283 3984 402291 3983->3984 3985 40228b 3983->3985 3987 4022a1 3984->3987 3988 402a3a 18 API calls 3984->3988 3986 402a3a 18 API calls 3985->3986 3986->3984 3989 4022af 3987->3989 3991 402a3a 18 API calls 3987->3991 3988->3987 3990 402a3a 18 API calls 3989->3990 3992 4022b8 WritePrivateProfileStringA 3990->3992 3991->3989 5313 401a03 5314 402a3a 18 API calls 5313->5314 5315 401a0c ExpandEnvironmentStringsA 5314->5315 5316 401a20 5315->5316 5318 401a33 5315->5318 5317 401a25 lstrcmpA 5316->5317 5316->5318 5317->5318 5319 100029c3 5320 100029db 5319->5320 5321 10001534 2 API calls 5320->5321 5322 100029f6 5321->5322 5323 404e86 5324 404e96 5323->5324 5325 404eaa 5323->5325 5326 404ef3 5324->5326 5327 404e9c 5324->5327 5328 404eb2 IsWindowVisible 5325->5328 5334 404ec9 5325->5334 5329 404ef8 CallWindowProcA 5326->5329 5330 403f2a SendMessageA 5327->5330 5328->5326 5331 404ebf 5328->5331 5332 404ea6 5329->5332 5330->5332 5336 4047dd SendMessageA 5331->5336 5334->5329 5341 40485d 5334->5341 5337 404800 GetMessagePos ScreenToClient SendMessageA 5336->5337 5338 40483c SendMessageA 5336->5338 5339 404834 5337->5339 5340 404839 5337->5340 5338->5339 5339->5334 5340->5338 5350 405cf9 lstrcpynA 5341->5350 5343 404870 5351 405c57 wsprintfA 5343->5351 5345 40487a 5346 40140b 2 API calls 5345->5346 5347 404883 5346->5347 5352 405cf9 lstrcpynA 5347->5352 5349 40488a 5349->5326 5350->5343 5351->5345 5352->5349 4081 402308 4082 402338 4081->4082 4083 40230d 4081->4083 4084 402a3a 18 API calls 4082->4084 4085 402b44 19 API calls 4083->4085 4086 40233f 4084->4086 4087 402314 4085->4087 4093 402a7a RegOpenKeyExA 4086->4093 4088 40231e 4087->4088 4092 402355 4087->4092 4089 402a3a 18 API calls 4088->4089 4090 402325 RegDeleteValueA RegCloseKey 4089->4090 4090->4092 4094 402aa5 4093->4094 4095 402b0e 4093->4095 4096 402acb RegEnumKeyA 4094->4096 4097 402add RegCloseKey 4094->4097 4099 402b02 RegCloseKey 4094->4099 4102 402a7a 5 API calls 4094->4102 4095->4092 4096->4094 4096->4097 4104 406092 GetModuleHandleA 4097->4104 4101 402af1 4099->4101 4101->4095 4102->4094 4103 402b1d RegDeleteKeyA 4103->4101 4105 4060b8 GetProcAddress 4104->4105 4106 4060ae 4104->4106 4108 402aed 4105->4108 4110 406024 GetSystemDirectoryA 4106->4110 4108->4101 4108->4103 4109 4060b4 4109->4105 4109->4108 4111 406046 wsprintfA LoadLibraryExA 4110->4111 4111->4109 5353 402688 5354 402a3a 18 API calls 5353->5354 5355 40268f FindFirstFileA 5354->5355 5356 4026b2 5355->5356 5357 4026a2 5355->5357 5358 4026b9 5356->5358 5361 405c57 wsprintfA 5356->5361 5362 405cf9 lstrcpynA 5358->5362 5361->5358 5362->5357 5363 401c8a 5364 402a1d 18 API calls 5363->5364 5365 401c90 IsWindow 5364->5365 5366 4019f3 5365->5366 4245 403a0b 4246 403a23 4245->4246 4247 403b5e 4245->4247 4246->4247 4248 403a2f 4246->4248 4249 403baf 4247->4249 4250 403b6f GetDlgItem GetDlgItem 4247->4250 4251 403a3a SetWindowPos 4248->4251 4252 403a4d 4248->4252 4254 403c09 4249->4254 4259 401389 2 API calls 4249->4259 4315 403ede 4250->4315 4251->4252 4256 403a52 ShowWindow 4252->4256 4257 403a6a 4252->4257 4260 403b59 4254->4260 4321 403f2a 4254->4321 4256->4257 4261 403a72 DestroyWindow 4257->4261 4262 403a8c 4257->4262 4258 403b99 KiUserCallbackDispatcher 4318 40140b 4258->4318 4264 403be1 4259->4264 4265 403e67 4261->4265 4266 403a91 SetWindowLongA 4262->4266 4267 403aa2 4262->4267 4264->4254 4268 403be5 SendMessageA 4264->4268 4265->4260 4276 403e98 ShowWindow 4265->4276 4266->4260 4271 403b4b 4267->4271 4272 403aae GetDlgItem 4267->4272 4268->4260 4269 40140b 2 API calls 4285 403c1b 4269->4285 4270 403e69 DestroyWindow EndDialog 4270->4265 4334 403f45 4271->4334 4273 403ac1 SendMessageA IsWindowEnabled 4272->4273 4274 403ade 4272->4274 4273->4260 4273->4274 4278 403aeb 4274->4278 4279 403b32 SendMessageA 4274->4279 4280 403afe 4274->4280 4290 403ae3 4274->4290 4276->4260 4277 405d1b 18 API calls 4277->4285 4278->4279 4278->4290 4279->4271 4282 403b06 4280->4282 4283 403b1b 4280->4283 4288 40140b 2 API calls 4282->4288 4286 40140b 2 API calls 4283->4286 4284 403b19 4284->4271 4285->4260 4285->4269 4285->4270 4285->4277 4287 403ede 19 API calls 4285->4287 4291 403ede 19 API calls 4285->4291 4306 403da9 DestroyWindow 4285->4306 4289 403b22 4286->4289 4287->4285 4288->4290 4289->4271 4289->4290 4331 403eb7 4290->4331 4292 403c96 GetDlgItem 4291->4292 4293 403cb3 ShowWindow KiUserCallbackDispatcher 4292->4293 4294 403cab 4292->4294 4324 403f00 KiUserCallbackDispatcher 4293->4324 4294->4293 4296 403cdd EnableWindow 4299 403cf1 4296->4299 4297 403cf6 GetSystemMenu EnableMenuItem SendMessageA 4298 403d26 SendMessageA 4297->4298 4297->4299 4298->4299 4299->4297 4325 403f13 SendMessageA 4299->4325 4326 405cf9 lstrcpynA 4299->4326 4302 403d54 lstrlenA 4303 405d1b 18 API calls 4302->4303 4304 403d65 SetWindowTextA 4303->4304 4327 401389 4304->4327 4306->4265 4307 403dc3 CreateDialogParamA 4306->4307 4307->4265 4308 403df6 4307->4308 4309 403ede 19 API calls 4308->4309 4310 403e01 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 4309->4310 4311 401389 2 API calls 4310->4311 4312 403e47 4311->4312 4312->4260 4313 403e4f ShowWindow 4312->4313 4314 403f2a SendMessageA 4313->4314 4314->4265 4316 405d1b 18 API calls 4315->4316 4317 403ee9 SetDlgItemTextA 4316->4317 4317->4258 4319 401389 2 API calls 4318->4319 4320 401420 4319->4320 4320->4249 4322 403f42 4321->4322 4323 403f33 SendMessageA 4321->4323 4322->4285 4323->4322 4324->4296 4325->4299 4326->4302 4329 401390 4327->4329 4328 4013fe 4328->4285 4329->4328 4330 4013cb MulDiv SendMessageA 4329->4330 4330->4329 4332 403ec4 SendMessageA 4331->4332 4333 403ebe 4331->4333 4332->4284 4333->4332 4335 403fe6 4334->4335 4336 403f5d GetWindowLongA 4334->4336 4335->4260 4336->4335 4337 403f6e 4336->4337 4338 403f80 4337->4338 4339 403f7d GetSysColor 4337->4339 4340 403f90 SetBkMode 4338->4340 4341 403f86 SetTextColor 4338->4341 4339->4338 4342 403fa8 GetSysColor 4340->4342 4343 403fae 4340->4343 4341->4340 4342->4343 4344 403fb5 SetBkColor 4343->4344 4345 403fbf 4343->4345 4344->4345 4345->4335 4346 403fd2 DeleteObject 4345->4346 4347 403fd9 CreateBrushIndirect 4345->4347 4346->4347 4347->4335 5367 40488f GetDlgItem GetDlgItem 5368 4048e1 7 API calls 5367->5368 5371 404af9 5367->5371 5369 404984 DeleteObject 5368->5369 5370 404977 SendMessageA 5368->5370 5372 40498d 5369->5372 5370->5369 5383 4047dd 5 API calls 5371->5383 5388 404bdd 5371->5388 5401 404b6a 5371->5401 5373 4049c4 5372->5373 5376 405d1b 18 API calls 5372->5376 5374 403ede 19 API calls 5373->5374 5380 4049d8 5374->5380 5375 404c89 5377 404c93 SendMessageA 5375->5377 5378 404c9b 5375->5378 5379 4049a6 SendMessageA SendMessageA 5376->5379 5377->5378 5389 404cb4 5378->5389 5390 404cad ImageList_Destroy 5378->5390 5397 404cc4 5378->5397 5379->5372 5384 403ede 19 API calls 5380->5384 5381 404aec 5386 403f45 8 API calls 5381->5386 5382 404bcf SendMessageA 5382->5388 5383->5401 5402 4049e6 5384->5402 5385 404c36 SendMessageA 5385->5381 5392 404c4b SendMessageA 5385->5392 5387 404e7f 5386->5387 5388->5375 5388->5381 5388->5385 5393 404cbd GlobalFree 5389->5393 5389->5397 5390->5389 5391 404e33 5391->5381 5398 404e45 ShowWindow GetDlgItem ShowWindow 5391->5398 5395 404c5e 5392->5395 5393->5397 5394 404aba GetWindowLongA SetWindowLongA 5396 404ad3 5394->5396 5406 404c6f SendMessageA 5395->5406 5399 404af1 5396->5399 5400 404ad9 ShowWindow 5396->5400 5397->5391 5410 40485d 4 API calls 5397->5410 5414 404cff 5397->5414 5398->5381 5419 403f13 SendMessageA 5399->5419 5418 403f13 SendMessageA 5400->5418 5401->5382 5401->5388 5402->5394 5405 404a35 SendMessageA 5402->5405 5407 404ab4 5402->5407 5408 404a71 SendMessageA 5402->5408 5409 404a82 SendMessageA 5402->5409 5405->5402 5406->5375 5407->5394 5407->5396 5408->5402 5409->5402 5410->5414 5411 404e09 InvalidateRect 5411->5391 5412 404e1f 5411->5412 5420 404798 5412->5420 5413 404d2d SendMessageA 5417 404d43 5413->5417 5414->5413 5414->5417 5416 404db7 SendMessageA SendMessageA 5416->5417 5417->5411 5417->5416 5418->5381 5419->5371 5423 4046d3 5420->5423 5422 4047ad 5422->5391 5424 4046e9 5423->5424 5425 405d1b 18 API calls 5424->5425 5426 40474d 5425->5426 5427 405d1b 18 API calls 5426->5427 5428 404758 5427->5428 5429 405d1b 18 API calls 5428->5429 5430 40476e lstrlenA wsprintfA SetDlgItemTextA 5429->5430 5430->5422 4404 401f90 4405 401fa2 4404->4405 4415 402050 4404->4415 4406 402a3a 18 API calls 4405->4406 4408 401fa9 4406->4408 4407 401423 25 API calls 4411 4021c9 4407->4411 4409 402a3a 18 API calls 4408->4409 4410 401fb2 4409->4410 4412 401fc7 LoadLibraryExA 4410->4412 4413 401fba GetModuleHandleA 4410->4413 4414 401fd7 GetProcAddress 4412->4414 4412->4415 4413->4412 4413->4414 4416 402023 4414->4416 4417 401fe6 4414->4417 4415->4407 4418 404f12 25 API calls 4416->4418 4419 402005 4417->4419 4420 401fee 4417->4420 4421 401ff6 4418->4421 4425 100016bd 4419->4425 4467 401423 4420->4467 4421->4411 4423 402044 FreeLibrary 4421->4423 4423->4411 4426 100016ed 4425->4426 4470 10001a5d 4426->4470 4428 100016f4 4429 1000180a 4428->4429 4430 10001705 4428->4430 4431 1000170c 4428->4431 4429->4421 4520 100021b0 4430->4520 4502 100021fa 4431->4502 4436 10001770 4440 100017b2 4436->4440 4441 10001776 4436->4441 4437 10001752 4533 100023da 4437->4533 4438 10001722 4443 10001728 4438->4443 4448 10001733 4438->4448 4439 1000173b 4452 10001731 4439->4452 4530 10002aa3 4439->4530 4446 100023da 10 API calls 4440->4446 4444 10001559 3 API calls 4441->4444 4443->4452 4514 100027e8 4443->4514 4451 1000178c 4444->4451 4453 100017a4 4446->4453 4447 10001758 4544 10001559 4447->4544 4524 10002589 4448->4524 4456 100023da 10 API calls 4451->4456 4452->4436 4452->4437 4458 100017f9 4453->4458 4555 100023a0 4453->4555 4455 10001739 4455->4452 4456->4453 4458->4429 4460 10001803 GlobalFree 4458->4460 4460->4429 4464 100017e5 4464->4458 4559 100014e2 wsprintfA 4464->4559 4466 100017de FreeLibrary 4466->4464 4468 404f12 25 API calls 4467->4468 4469 401431 4468->4469 4469->4421 4562 10001215 GlobalAlloc 4470->4562 4472 10001a81 4563 10001215 GlobalAlloc 4472->4563 4474 10001cbb GlobalFree GlobalFree GlobalFree 4476 10001cd8 4474->4476 4494 10001d22 4474->4494 4475 10001a8c 4475->4474 4479 10001b60 GlobalAlloc 4475->4479 4481 10001bc9 GlobalFree 4475->4481 4484 10001bab lstrcpyA 4475->4484 4486 10001bb5 lstrcpyA 4475->4486 4488 10001f7a 4475->4488 4475->4494 4496 10001c07 4475->4496 4497 10001e75 GlobalFree 4475->4497 4500 10001224 2 API calls 4475->4500 4569 10001215 GlobalAlloc 4475->4569 4477 1000201a 4476->4477 4478 10001ced 4476->4478 4476->4494 4480 1000203c GetModuleHandleA 4477->4480 4477->4494 4478->4494 4566 10001224 4478->4566 4479->4475 4482 10002062 4480->4482 4483 1000204d LoadLibraryA 4480->4483 4481->4475 4570 100015a4 GetProcAddress 4482->4570 4483->4482 4483->4494 4484->4486 4486->4475 4487 100020b3 4489 100020c0 lstrlenA 4487->4489 4487->4494 4493 10001fbe lstrcpyA 4488->4493 4488->4494 4571 100015a4 GetProcAddress 4489->4571 4493->4494 4494->4428 4495 10002074 4495->4487 4501 1000209d GetProcAddress 4495->4501 4496->4475 4564 10001534 GlobalSize GlobalAlloc 4496->4564 4497->4475 4498 100020d9 4498->4494 4500->4475 4501->4487 4511 10002212 4502->4511 4504 10002349 GlobalFree 4507 10001712 4504->4507 4504->4511 4505 100022b9 GlobalAlloc MultiByteToWideChar 4508 10002303 4505->4508 4510 100022e3 GlobalAlloc 4505->4510 4506 1000230a lstrlenA 4506->4504 4506->4508 4507->4438 4507->4439 4507->4452 4508->4504 4577 1000251d 4508->4577 4509 10001224 GlobalAlloc lstrcpynA 4509->4511 4512 100022fa GlobalFree 4510->4512 4511->4504 4511->4505 4511->4506 4511->4509 4573 100012ad 4511->4573 4512->4504 4516 100027fa 4514->4516 4515 1000289f CreateFileA 4517 100028bd 4515->4517 4516->4515 4518 100029b9 4517->4518 4519 100029ae GetLastError 4517->4519 4518->4452 4519->4518 4521 100021c0 4520->4521 4522 1000170b 4520->4522 4521->4522 4523 100021d2 GlobalAlloc 4521->4523 4522->4431 4523->4521 4528 100025a5 4524->4528 4525 100025f6 GlobalAlloc 4529 10002618 4525->4529 4526 10002609 4527 1000260e GlobalSize 4526->4527 4526->4529 4527->4529 4528->4525 4528->4526 4529->4455 4531 10002aae 4530->4531 4532 10002aee GlobalFree 4531->4532 4580 10001215 GlobalAlloc 4533->4580 4535 1000243a lstrcpynA 4542 100023e6 4535->4542 4536 1000246f WideCharToMultiByte 4536->4542 4537 100024b4 GlobalFree 4537->4542 4538 10002490 wsprintfA 4538->4542 4539 100024ee GlobalFree 4539->4447 4540 1000245a WideCharToMultiByte 4540->4542 4541 10001266 2 API calls 4541->4542 4542->4535 4542->4536 4542->4537 4542->4538 4542->4539 4542->4540 4542->4541 4581 100012d1 4542->4581 4585 10001215 GlobalAlloc 4544->4585 4546 1000155f 4547 1000156c lstrcpyA 4546->4547 4549 10001586 4546->4549 4550 100015a0 4547->4550 4549->4550 4551 1000158b wsprintfA 4549->4551 4552 10001266 4550->4552 4551->4550 4553 100012a8 GlobalFree 4552->4553 4554 1000126f GlobalAlloc lstrcpynA 4552->4554 4553->4453 4554->4553 4556 100023ae 4555->4556 4558 100017c5 4555->4558 4557 100023c7 GlobalFree 4556->4557 4556->4558 4557->4556 4558->4464 4558->4466 4560 10001266 2 API calls 4559->4560 4561 10001503 4560->4561 4561->4458 4562->4472 4563->4475 4565 10001552 4564->4565 4565->4496 4572 10001215 GlobalAlloc 4566->4572 4568 10001233 lstrcpynA 4568->4494 4569->4475 4570->4495 4571->4498 4572->4568 4574 100012b4 4573->4574 4575 10001224 2 API calls 4574->4575 4576 100012cf 4575->4576 4576->4511 4578 10002581 4577->4578 4579 1000252b VirtualAlloc 4577->4579 4578->4508 4579->4578 4580->4542 4582 100012f9 4581->4582 4583 100012da 4581->4583 4582->4542 4583->4582 4584 100012e0 lstrcpyA 4583->4584 4584->4582 4585->4546 4586 402410 4587 402b44 19 API calls 4586->4587 4588 40241a 4587->4588 4589 402a3a 18 API calls 4588->4589 4590 402423 4589->4590 4591 4026a6 4590->4591 4592 40242d RegQueryValueExA 4590->4592 4593 40244d 4592->4593 4596 402453 RegCloseKey 4592->4596 4593->4596 4597 405c57 wsprintfA 4593->4597 4596->4591 4597->4596 5431 401490 5432 404f12 25 API calls 5431->5432 5433 401497 5432->5433 4689 401595 4690 402a3a 18 API calls 4689->4690 4691 40159c SetFileAttributesA 4690->4691 4692 4015ae 4691->4692 4698 402616 4699 40261d 4698->4699 4705 40287c 4698->4705 4700 402a1d 18 API calls 4699->4700 4701 402628 4700->4701 4702 40262f SetFilePointer 4701->4702 4703 40263f 4702->4703 4702->4705 4706 405c57 wsprintfA 4703->4706 4706->4705 4707 401717 4708 402a3a 18 API calls 4707->4708 4709 40171e SearchPathA 4708->4709 4710 401739 4709->4710 5441 10001058 5443 10001074 5441->5443 5442 100010dc 5443->5442 5444 100014bb GlobalFree 5443->5444 5445 10001091 5443->5445 5444->5445 5446 100014bb GlobalFree 5445->5446 5447 100010a1 5446->5447 5448 100010b1 5447->5448 5449 100010a8 GlobalSize 5447->5449 5450 100010b5 GlobalAlloc 5448->5450 5451 100010c6 5448->5451 5449->5448 5452 100014e2 3 API calls 5450->5452 5453 100010d1 GlobalFree 5451->5453 5452->5451 5453->5442 5454 402519 5455 40252e 5454->5455 5456 40251e 5454->5456 5457 402a3a 18 API calls 5455->5457 5458 402a1d 18 API calls 5456->5458 5459 402535 lstrlenA 5457->5459 5460 402527 5458->5460 5459->5460 5461 405a13 WriteFile 5460->5461 5462 402557 5460->5462 5461->5462 5463 40431c 5464 404348 5463->5464 5465 404359 5463->5465 5524 4054d3 GetDlgItemTextA 5464->5524 5467 404365 GetDlgItem 5465->5467 5473 4043c4 5465->5473 5470 404379 5467->5470 5468 4044a8 5522 404652 5468->5522 5526 4054d3 GetDlgItemTextA 5468->5526 5469 404353 5471 405f64 5 API calls 5469->5471 5472 40438d SetWindowTextA 5470->5472 5476 405804 4 API calls 5470->5476 5471->5465 5477 403ede 19 API calls 5472->5477 5473->5468 5478 405d1b 18 API calls 5473->5478 5473->5522 5475 403f45 8 API calls 5480 404666 5475->5480 5481 404383 5476->5481 5482 4043a9 5477->5482 5483 404438 SHBrowseForFolderA 5478->5483 5479 4044d8 5484 405859 18 API calls 5479->5484 5481->5472 5488 40576b 3 API calls 5481->5488 5485 403ede 19 API calls 5482->5485 5483->5468 5486 404450 CoTaskMemFree 5483->5486 5487 4044de 5484->5487 5489 4043b7 5485->5489 5490 40576b 3 API calls 5486->5490 5527 405cf9 lstrcpynA 5487->5527 5488->5472 5525 403f13 SendMessageA 5489->5525 5492 40445d 5490->5492 5495 404494 SetDlgItemTextA 5492->5495 5499 405d1b 18 API calls 5492->5499 5494 4043bd 5497 406092 5 API calls 5494->5497 5495->5468 5496 4044f5 5498 406092 5 API calls 5496->5498 5497->5473 5506 4044fc 5498->5506 5501 40447c lstrcmpiA 5499->5501 5500 404538 5528 405cf9 lstrcpynA 5500->5528 5501->5495 5502 40448d lstrcatA 5501->5502 5502->5495 5504 40453f 5505 405804 4 API calls 5504->5505 5507 404545 GetDiskFreeSpaceA 5505->5507 5506->5500 5510 4057b2 2 API calls 5506->5510 5511 404590 5506->5511 5509 404569 MulDiv 5507->5509 5507->5511 5509->5511 5510->5506 5512 404601 5511->5512 5514 404798 21 API calls 5511->5514 5513 404624 5512->5513 5515 40140b 2 API calls 5512->5515 5529 403f00 KiUserCallbackDispatcher 5513->5529 5516 4045ee 5514->5516 5515->5513 5518 404603 SetDlgItemTextA 5516->5518 5519 4045f3 5516->5519 5518->5512 5521 4046d3 21 API calls 5519->5521 5520 404640 5520->5522 5530 4042b1 5520->5530 5521->5512 5522->5475 5524->5469 5525->5494 5526->5479 5527->5496 5528->5504 5529->5520 5531 4042c4 SendMessageA 5530->5531 5532 4042bf 5530->5532 5531->5522 5532->5531 5533 40149d 5534 4014ab PostQuitMessage 5533->5534 5535 40226e 5533->5535 5534->5535 5536 100010e0 5545 1000110e 5536->5545 5537 100011c4 GlobalFree 5538 100012ad 2 API calls 5538->5545 5539 100011c3 5539->5537 5540 10001266 2 API calls 5543 100011b1 GlobalFree 5540->5543 5541 10001155 GlobalAlloc 5541->5545 5542 100011ea GlobalFree 5542->5545 5543->5545 5544 100012d1 lstrcpyA 5544->5545 5545->5537 5545->5538 5545->5539 5545->5540 5545->5541 5545->5542 5545->5543 5545->5544 5546 10002162 5547 100021c0 5546->5547 5548 100021f6 5546->5548 5547->5548 5549 100021d2 GlobalAlloc 5547->5549 5549->5547 5550 401b23 5551 401b74 5550->5551 5556 401b30 5550->5556 5552 401b9d GlobalAlloc 5551->5552 5553 401b78 5551->5553 5555 405d1b 18 API calls 5552->5555 5564 40226e 5553->5564 5571 405cf9 lstrcpynA 5553->5571 5554 405d1b 18 API calls 5559 402268 5554->5559 5560 401bb8 5555->5560 5557 401b47 5556->5557 5556->5560 5569 405cf9 lstrcpynA 5557->5569 5565 4054ef MessageBoxIndirectA 5559->5565 5560->5554 5560->5564 5562 401b8a GlobalFree 5562->5564 5563 401b56 5570 405cf9 lstrcpynA 5563->5570 5565->5564 5567 401b65 5572 405cf9 lstrcpynA 5567->5572 5569->5563 5570->5567 5571->5562 5572->5564 5573 404027 5574 404149 5573->5574 5575 40403d 5573->5575 5576 4041b8 5574->5576 5581 40428c 5574->5581 5585 40418d GetDlgItem SendMessageA 5574->5585 5578 403ede 19 API calls 5575->5578 5577 4041c2 GetDlgItem 5576->5577 5576->5581 5580 40424a 5577->5580 5584 4041d8 5577->5584 5579 404093 5578->5579 5583 403ede 19 API calls 5579->5583 5580->5581 5589 40425c 5580->5589 5582 403f45 8 API calls 5581->5582 5586 404287 5582->5586 5587 4040a0 CheckDlgButton 5583->5587 5584->5580 5588 4041fe 6 API calls 5584->5588 5604 403f00 KiUserCallbackDispatcher 5585->5604 5602 403f00 KiUserCallbackDispatcher 5587->5602 5588->5580 5592 404262 SendMessageA 5589->5592 5593 404273 5589->5593 5592->5593 5593->5586 5597 404279 SendMessageA 5593->5597 5594 4041b3 5595 4042b1 SendMessageA 5594->5595 5595->5576 5596 4040be GetDlgItem 5603 403f13 SendMessageA 5596->5603 5597->5586 5599 4040d4 SendMessageA 5600 4040f2 GetSysColor 5599->5600 5601 4040fb SendMessageA SendMessageA lstrlenA SendMessageA SendMessageA 5599->5601 5600->5601 5601->5586 5602->5596 5603->5599 5604->5594 5605 401ca7 5606 402a1d 18 API calls 5605->5606 5607 401cae 5606->5607 5608 402a1d 18 API calls 5607->5608 5609 401cb6 GetDlgItem 5608->5609 5610 402513 5609->5610 4113 40192a 4114 40192c 4113->4114 4115 402a3a 18 API calls 4114->4115 4116 401931 4115->4116 4119 40559b 4116->4119 4160 405859 4119->4160 4122 4055c3 DeleteFileA 4124 40193a 4122->4124 4123 4055da 4125 405712 4123->4125 4174 405cf9 lstrcpynA 4123->4174 4125->4124 4192 405ffd FindFirstFileA 4125->4192 4127 405600 4128 405613 4127->4128 4129 405606 lstrcatA 4127->4129 4175 4057b2 lstrlenA 4128->4175 4130 405619 4129->4130 4133 405627 lstrcatA 4130->4133 4134 40561e 4130->4134 4136 405632 lstrlenA FindFirstFileA 4133->4136 4134->4133 4134->4136 4138 405708 4136->4138 4158 405656 4136->4158 4137 405730 4195 40576b lstrlenA CharPrevA 4137->4195 4138->4125 4141 405796 CharNextA 4141->4158 4142 405553 5 API calls 4143 405742 4142->4143 4144 40575c 4143->4144 4146 405746 4143->4146 4147 404f12 25 API calls 4144->4147 4146->4124 4149 404f12 25 API calls 4146->4149 4147->4124 4148 4056e7 FindNextFileA 4150 4056ff FindClose 4148->4150 4148->4158 4151 405753 4149->4151 4150->4138 4152 405bb4 38 API calls 4151->4152 4155 40575a 4152->4155 4154 40559b 62 API calls 4154->4158 4155->4124 4156 404f12 25 API calls 4156->4148 4157 404f12 25 API calls 4157->4158 4158->4141 4158->4148 4158->4154 4158->4156 4158->4157 4179 405cf9 lstrcpynA 4158->4179 4180 405553 4158->4180 4188 405bb4 MoveFileExA 4158->4188 4198 405cf9 lstrcpynA 4160->4198 4162 40586a 4199 405804 CharNextA CharNextA 4162->4199 4165 4055bb 4165->4122 4165->4123 4166 405f64 5 API calls 4172 405880 4166->4172 4167 4058ab lstrlenA 4168 4058b6 4167->4168 4167->4172 4170 40576b 3 API calls 4168->4170 4169 405ffd 2 API calls 4169->4172 4171 4058bb GetFileAttributesA 4170->4171 4171->4165 4172->4165 4172->4167 4172->4169 4173 4057b2 2 API calls 4172->4173 4173->4167 4174->4127 4176 4057bf 4175->4176 4177 4057d0 4176->4177 4178 4057c4 CharPrevA 4176->4178 4177->4130 4178->4176 4178->4177 4179->4158 4205 405947 GetFileAttributesA 4180->4205 4183 405576 DeleteFileA 4185 40557c 4183->4185 4184 40556e RemoveDirectoryA 4184->4185 4186 405580 4185->4186 4187 40558c SetFileAttributesA 4185->4187 4186->4158 4187->4186 4189 405bd5 4188->4189 4190 405bc8 4188->4190 4189->4158 4208 405a42 lstrcpyA 4190->4208 4193 406013 FindClose 4192->4193 4194 40572c 4192->4194 4193->4194 4194->4124 4194->4137 4196 405736 4195->4196 4197 405785 lstrcatA 4195->4197 4196->4142 4197->4196 4198->4162 4200 40581f 4199->4200 4203 40582f 4199->4203 4201 40582a CharNextA 4200->4201 4200->4203 4204 40584f 4201->4204 4202 405796 CharNextA 4202->4203 4203->4202 4203->4204 4204->4165 4204->4166 4206 40555f 4205->4206 4207 405959 SetFileAttributesA 4205->4207 4206->4183 4206->4184 4206->4186 4207->4206 4209 405a90 GetShortPathNameA 4208->4209 4210 405a6a 4208->4210 4212 405aa5 4209->4212 4213 405baf 4209->4213 4235 40596c GetFileAttributesA CreateFileA 4210->4235 4212->4213 4215 405aad wsprintfA 4212->4215 4213->4189 4214 405a74 CloseHandle GetShortPathNameA 4214->4213 4216 405a88 4214->4216 4217 405d1b 18 API calls 4215->4217 4216->4209 4216->4213 4218 405ad5 4217->4218 4236 40596c GetFileAttributesA CreateFileA 4218->4236 4220 405ae2 4220->4213 4221 405af1 GetFileSize GlobalAlloc 4220->4221 4222 405b13 4221->4222 4223 405ba8 CloseHandle 4221->4223 4224 4059e4 ReadFile 4222->4224 4223->4213 4225 405b1b 4224->4225 4225->4223 4237 4058d1 lstrlenA 4225->4237 4228 405b32 lstrcpyA 4230 405b54 4228->4230 4229 405b46 4231 4058d1 4 API calls 4229->4231 4232 405b8b SetFilePointer 4230->4232 4231->4230 4233 405a13 WriteFile 4232->4233 4234 405ba1 GlobalFree 4233->4234 4234->4223 4235->4214 4236->4220 4238 405912 lstrlenA 4237->4238 4239 40591a 4238->4239 4240 4058eb lstrcmpiA 4238->4240 4239->4228 4239->4229 4240->4239 4241 405909 CharNextA 4240->4241 4241->4238 5618 4028aa SendMessageA 5619 4028c4 InvalidateRect 5618->5619 5620 4028cf 5618->5620 5619->5620 4658 4015b3 4659 402a3a 18 API calls 4658->4659 4660 4015ba 4659->4660 4661 405804 4 API calls 4660->4661 4666 4015c2 4661->4666 4662 40161c 4664 401621 4662->4664 4665 40164a 4662->4665 4663 405796 CharNextA 4663->4666 4667 401423 25 API calls 4664->4667 4669 401423 25 API calls 4665->4669 4666->4662 4666->4663 4675 401604 GetFileAttributesA 4666->4675 4677 405472 4666->4677 4680 4053d8 CreateDirectoryA 4666->4680 4686 405455 CreateDirectoryA 4666->4686 4668 401628 4667->4668 4685 405cf9 lstrcpynA 4668->4685 4674 401642 4669->4674 4673 401633 SetCurrentDirectoryA 4673->4674 4675->4666 4678 406092 5 API calls 4677->4678 4679 405479 4678->4679 4679->4666 4681 405425 4680->4681 4682 405429 GetLastError 4680->4682 4681->4666 4682->4681 4683 405438 SetFileSecurityA 4682->4683 4683->4681 4684 40544e GetLastError 4683->4684 4684->4681 4685->4673 4687 405465 4686->4687 4688 405469 GetLastError 4686->4688 4687->4666 4688->4687 5621 4016b3 5622 402a3a 18 API calls 5621->5622 5623 4016b9 GetFullPathNameA 5622->5623 5624 4016d0 5623->5624 5630 4016f1 5623->5630 5627 405ffd 2 API calls 5624->5627 5624->5630 5625 401705 GetShortPathNameA 5626 4028cf 5625->5626 5628 4016e1 5627->5628 5628->5630 5631 405cf9 lstrcpynA 5628->5631 5630->5625 5630->5626 5631->5630 5632 403637 5633 403642 5632->5633 5634 403646 5633->5634 5635 403649 GlobalAlloc 5633->5635 5635->5634 5636 406a37 5637 4061c8 5636->5637 5637->5637 5638 406252 GlobalAlloc 5637->5638 5639 406249 GlobalFree 5637->5639 5640 406b33 5637->5640 5641 4062c0 GlobalFree 5637->5641 5642 4062c9 GlobalAlloc 5637->5642 5638->5637 5638->5640 5639->5638 5641->5642 5642->5637 5642->5640 5643 4014b7 5644 4014bd 5643->5644 5645 401389 2 API calls 5644->5645 5646 4014c5 5645->5646 5647 401d38 GetDC GetDeviceCaps 5648 402a1d 18 API calls 5647->5648 5649 401d56 MulDiv ReleaseDC 5648->5649 5650 402a1d 18 API calls 5649->5650 5651 401d75 5650->5651 5652 405d1b 18 API calls 5651->5652 5653 401dae CreateFontIndirectA 5652->5653 5654 402513 5653->5654 4958 40173e 4959 402a3a 18 API calls 4958->4959 4960 401745 4959->4960 4961 40599b 2 API calls 4960->4961 4962 40174c 4961->4962 4963 40599b 2 API calls 4962->4963 4963->4962 5655 401ebe 5656 402a3a 18 API calls 5655->5656 5657 401ec5 5656->5657 5658 405ffd 2 API calls 5657->5658 5659 401ecb 5658->5659 5661 401edd 5659->5661 5662 405c57 wsprintfA 5659->5662 5662->5661 5663 40193f 5664 402a3a 18 API calls 5663->5664 5665 401946 lstrlenA 5664->5665 5666 402513 5665->5666

                                                          Executed Functions

                                                          Function 004030D9 Relevance: 89.6, APIs: 33, Strings: 18, Instructions: 357stringcomfileCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 0 4030d9-40310e SetErrorMode GetVersion 1 403110-403118 call 406092 0->1 2 403121 0->2 1->2 7 40311a 1->7 4 403126-403139 call 406024 lstrlenA 2->4 9 40313b-4031ae call 406092 * 2 #17 OleInitialize SHGetFileInfoA call 405cf9 GetCommandLineA call 405cf9 GetModuleHandleA 4->9 7->2 18 4031b0-4031b5 9->18 19 4031ba-4031cf call 405796 CharNextA 9->19 18->19 22 403294-403298 19->22 23 4031d4-4031d7 22->23 24 40329e 22->24 25 4031d9-4031dd 23->25 26 4031df-4031e7 23->26 27 4032b1-4032cb GetTempPathA call 4030a8 24->27 25->25 25->26 28 4031e9-4031ea 26->28 29 4031ef-4031f2 26->29 37 403323-40333d DeleteFileA call 402c66 27->37 38 4032cd-4032eb GetWindowsDirectoryA lstrcatA call 4030a8 27->38 28->29 31 403284-403291 call 405796 29->31 32 4031f8-4031fc 29->32 31->22 50 403293 31->50 35 403214-403241 32->35 36 4031fe-403204 32->36 43 403243-403249 35->43 44 403254-403282 35->44 41 403206-403208 36->41 42 40320a 36->42 53 4033d1-4033e1 call 40359f OleUninitialize 37->53 54 403343-403349 37->54 38->37 52 4032ed-40331d GetTempPathA lstrcatA SetEnvironmentVariableA * 2 call 4030a8 38->52 41->35 41->42 42->35 46 40324b-40324d 43->46 47 40324f 43->47 44->31 49 4032a0-4032ac call 405cf9 44->49 46->44 46->47 47->44 49->27 50->22 52->37 52->53 66 403505-40350b 53->66 67 4033e7-4033f7 call 4054ef ExitProcess 53->67 57 4033c1-4033c8 call 403679 54->57 58 40334b-403356 call 405796 54->58 64 4033cd 57->64 70 403358-403381 58->70 71 40338c-403396 58->71 64->53 68 403587-40358f 66->68 69 40350d-403526 GetCurrentProcess OpenProcessToken 66->69 76 403591 68->76 77 403595-403599 ExitProcess 68->77 73 403558-403566 call 406092 69->73 74 403528-403552 LookupPrivilegeValueA AdjustTokenPrivileges 69->74 75 403383-403385 70->75 78 403398-4033a5 call 405859 71->78 79 4033fd-403411 call 405472 lstrcatA 71->79 91 403574-40357e ExitWindowsEx 73->91 92 403568-403572 73->92 74->73 75->71 84 403387-40338a 75->84 76->77 78->53 88 4033a7-4033bd call 405cf9 * 2 78->88 89 403413-403419 lstrcatA 79->89 90 40341e-403438 lstrcatA lstrcmpiA 79->90 84->71 84->75 88->57 89->90 90->53 94 40343a-40343d 90->94 91->68 95 403580-403582 call 40140b 91->95 92->91 92->95 97 403446 call 405455 94->97 98 40343f-403444 call 4053d8 94->98 95->68 106 40344b-403458 SetCurrentDirectoryA 97->106 98->106 107 403465-40348d call 405cf9 106->107 108 40345a-403460 call 405cf9 106->108 112 403493-4034af call 405d1b DeleteFileA 107->112 108->107 115 4034f0-4034f7 112->115 116 4034b1-4034c1 CopyFileA 112->116 115->112 118 4034f9-403500 call 405bb4 115->118 116->115 117 4034c3-4034e3 call 405bb4 call 405d1b call 40548a 116->117 117->115 127 4034e5-4034ec CloseHandle 117->127 118->53 127->115
                                                          C-Code - Quality: 87%
                                                          			_entry_() {
				intOrPtr _t45;
				CHAR* _t49;
				char* _t52;
				CHAR* _t54;
				void* _t58;
				intOrPtr _t60;
				int _t62;
				int _t65;
				signed int _t66;
				int _t67;
				signed int _t69;
				void* _t93;
				signed int _t109;
				void* _t112;
				void* _t117;
				intOrPtr* _t118;
				char _t121;
				signed int _t140;
				signed int _t141;
				int _t149;
				void* _t150;
				intOrPtr* _t152;
				CHAR* _t155;
				CHAR* _t156;
				void* _t158;
				char* _t159;
				void* _t162;
				void* _t163;
				char _t185;

				 *(_t163 + 0x18) = 0;
				 *((intOrPtr*)(_t163 + 0x10)) = "Error writing temporary file. Make sure your temp folder is valid.";
				 *(_t163 + 0x20) = 0;
				 *(_t163 + 0x14) = 0x20;
				SetErrorMode(0x8001); // executed
				if(GetVersion() != 6) {
					_t118 = E00406092(0);
					if(_t118 != 0) {
						 *_t118(0xc00);
					}
				}
				_t155 = "UXTHEME";
				do {
					E00406024(_t155); // executed
					_t155 =  &(_t155[lstrlenA(_t155) + 1]);
				} while ( *_t155 != 0);
				E00406092(9);
				_t45 = E00406092(7);
				 *0x423704 = _t45;
				__imp__#17(_t158);
				__imp__OleInitialize(0); // executed
				 *0x4237b8 = _t45;
				SHGetFileInfoA(0x41ecc8, 0, _t163 + 0x38, 0x160, 0); // executed
				E00405CF9(0x422f00, "NSIS Error");
				_t49 = GetCommandLineA();
				_t159 = "\"C:\\Users\\hardz\\Desktop\\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe\"";
				E00405CF9(_t159, _t49);
				 *0x423700 = GetModuleHandleA(0);
				_t52 = _t159;
				if("\"C:\\Users\\hardz\\Desktop\\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe\"" == 0x22) {
					 *(_t163 + 0x14) = 0x22;
					_t52 =  &M00429001;
				}
				_t54 = CharNextA(E00405796(_t52,  *(_t163 + 0x14)));
				 *(_t163 + 0x1c) = _t54;
				while(1) {
					_t121 =  *_t54;
					_t168 = _t121;
					if(_t121 == 0) {
						break;
					}
					__eflags = _t121 - 0x20;
					if(_t121 != 0x20) {
						L10:
						__eflags =  *_t54 - 0x22;
						 *(_t163 + 0x14) = 0x20;
						if( *_t54 == 0x22) {
							_t54 =  &(_t54[1]);
							__eflags = _t54;
							 *(_t163 + 0x14) = 0x22;
						}
						__eflags =  *_t54 - 0x2f;
						if( *_t54 != 0x2f) {
							L22:
							_t54 = E00405796(_t54,  *(_t163 + 0x14));
							__eflags =  *_t54 - 0x22;
							if(__eflags == 0) {
								_t54 =  &(_t54[1]);
								__eflags = _t54;
							}
							continue;
						} else {
							_t54 =  &(_t54[1]);
							__eflags =  *_t54 - 0x53;
							if( *_t54 != 0x53) {
								L17:
								__eflags =  *_t54 - ((( *0x409183 << 0x00000008 |  *0x409182) << 0x00000008 |  *0x409181) << 0x00000008 | "NCRC");
								if( *_t54 != ((( *0x409183 << 0x00000008 |  *0x409182) << 0x00000008 |  *0x409181) << 0x00000008 | "NCRC")) {
									L21:
									__eflags =  *((intOrPtr*)(_t54 - 2)) - ((( *0x40917b << 0x00000008 |  *0x40917a) << 0x00000008 |  *0x409179) << 0x00000008 | " /D=");
									if( *((intOrPtr*)(_t54 - 2)) == ((( *0x40917b << 0x00000008 |  *0x40917a) << 0x00000008 |  *0x409179) << 0x00000008 | " /D=")) {
										 *((char*)(_t54 - 2)) = 0;
										__eflags =  &(_t54[2]);
										E00405CF9("C:\\Users\\hardz\\Pacifisterne\\Automatcafeer",  &(_t54[2]));
										L27:
										_t156 = "C:\\Users\\hardz\\AppData\\Local\\Temp\\";
										GetTempPathA(0x400, _t156);
										_t58 = E004030A8(_t168);
										_t169 = _t58;
										if(_t58 != 0) {
											L30:
											DeleteFileA("1033"); // executed
											_t60 = E00402C66(_t171,  *(_t163 + 0x20)); // executed
											 *((intOrPtr*)(_t163 + 0x10)) = _t60;
											if(_t60 != 0) {
												L40:
												E0040359F();
												__imp__OleUninitialize();
												_t181 =  *((intOrPtr*)(_t163 + 0x10));
												if( *((intOrPtr*)(_t163 + 0x10)) == 0) {
													__eflags =  *0x423794;
													if( *0x423794 == 0) {
														L64:
														_t62 =  *0x4237ac;
														__eflags = _t62 - 0xffffffff;
														if(_t62 != 0xffffffff) {
															 *(_t163 + 0x14) = _t62;
														}
														ExitProcess( *(_t163 + 0x14));
													}
													_t65 = OpenProcessToken(GetCurrentProcess(), 0x28, _t163 + 0x18);
													__eflags = _t65;
													_t149 = 2;
													if(_t65 != 0) {
														LookupPrivilegeValueA(0, "SeShutdownPrivilege", _t163 + 0x24);
														 *(_t163 + 0x38) = 1;
														 *(_t163 + 0x44) = _t149;
														AdjustTokenPrivileges( *(_t163 + 0x2c), 0, _t163 + 0x28, 0, 0, 0);
													}
													_t66 = E00406092(4);
													__eflags = _t66;
													if(_t66 == 0) {
														L62:
														_t67 = ExitWindowsEx(_t149, 0x80040002);
														__eflags = _t67;
														if(_t67 != 0) {
															goto L64;
														}
														goto L63;
													} else {
														_t69 =  *_t66(0, 0, 0, 0x25, 0x80040002);
														__eflags = _t69;
														if(_t69 == 0) {
															L63:
															E0040140B(9);
															goto L64;
														}
														goto L62;
													}
												}
												E004054EF( *((intOrPtr*)(_t163 + 0x10)), 0x200010);
												ExitProcess(2);
											}
											if( *0x42371c == 0) {
												L39:
												 *0x4237ac =  *0x4237ac | 0xffffffff;
												 *(_t163 + 0x18) = E00403679( *0x4237ac);
												goto L40;
											}
											_t152 = E00405796(_t159, 0);
											if(_t152 < _t159) {
												L36:
												_t178 = _t152 - _t159;
												 *((intOrPtr*)(_t163 + 0x10)) = "Error launching installer";
												if(_t152 < _t159) {
													_t150 = E00405472(_t181);
													lstrcatA(_t156, "~nsu");
													if(_t150 != 0) {
														lstrcatA(_t156, "A");
													}
													lstrcatA(_t156, ".tmp");
													_t161 = "C:\\Users\\hardz\\Desktop";
													if(lstrcmpiA(_t156, "C:\\Users\\hardz\\Desktop") != 0) {
														_push(_t156);
														if(_t150 == 0) {
															E00405455();
														} else {
															E004053D8();
														}
														SetCurrentDirectoryA(_t156);
														_t185 = "C:\\Users\\hardz\\Pacifisterne\\Automatcafeer"; // 0x43
														if(_t185 == 0) {
															E00405CF9("C:\\Users\\hardz\\Pacifisterne\\Automatcafeer", _t161);
														}
														E00405CF9(0x424000,  *(_t163 + 0x1c));
														_t136 = "A";
														_t162 = 0x1a;
														 *0x424400 = "A";
														do {
															E00405D1B(0, 0x41e8c8, _t156, 0x41e8c8,  *((intOrPtr*)( *0x423710 + 0x120)));
															DeleteFileA(0x41e8c8);
															if( *((intOrPtr*)(_t163 + 0x10)) != 0 && CopyFileA("C:\\Users\\hardz\\Desktop\\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe", 0x41e8c8, 1) != 0) {
																E00405BB4(_t136, 0x41e8c8, 0);
																E00405D1B(0, 0x41e8c8, _t156, 0x41e8c8,  *((intOrPtr*)( *0x423710 + 0x124)));
																_t93 = E0040548A(0x41e8c8);
																if(_t93 != 0) {
																	CloseHandle(_t93);
																	 *((intOrPtr*)(_t163 + 0x10)) = 0;
																}
															}
															 *0x424400 =  *0x424400 + 1;
															_t162 = _t162 - 1;
														} while (_t162 != 0);
														E00405BB4(_t136, _t156, 0);
													}
													goto L40;
												}
												 *_t152 = 0;
												_t153 = _t152 + 4;
												if(E00405859(_t178, _t152 + 4) == 0) {
													goto L40;
												}
												E00405CF9("C:\\Users\\hardz\\Pacifisterne\\Automatcafeer", _t153);
												E00405CF9("C:\\Users\\hardz\\Pacifisterne\\Automatcafeer\\Syntaksgenkendelsernes\\Temposkifterne", _t153);
												 *((intOrPtr*)(_t163 + 0x10)) = 0;
												goto L39;
											}
											_t109 = (( *0x40915b << 0x00000008 |  *0x40915a) << 0x00000008 |  *0x409159) << 0x00000008 | " _?=";
											while( *_t152 != _t109) {
												_t152 = _t152 - 1;
												if(_t152 >= _t159) {
													continue;
												}
												goto L36;
											}
											goto L36;
										}
										GetWindowsDirectoryA(_t156, 0x3fb);
										lstrcatA(_t156, "\\Temp");
										_t112 = E004030A8(_t169);
										_t170 = _t112;
										if(_t112 != 0) {
											goto L30;
										}
										GetTempPathA(0x3fc, _t156);
										lstrcatA(_t156, "Low");
										SetEnvironmentVariableA("TEMP", _t156);
										SetEnvironmentVariableA("TMP", _t156);
										_t117 = E004030A8(_t170);
										_t171 = _t117;
										if(_t117 == 0) {
											goto L40;
										}
										goto L30;
									}
									goto L22;
								}
								_t140 = _t54[4];
								__eflags = _t140 - 0x20;
								if(_t140 == 0x20) {
									L20:
									_t15 = _t163 + 0x20;
									 *_t15 =  *(_t163 + 0x20) | 0x00000004;
									__eflags =  *_t15;
									goto L21;
								}
								__eflags = _t140;
								if(_t140 != 0) {
									goto L21;
								}
								goto L20;
							}
							_t141 = _t54[1];
							__eflags = _t141 - 0x20;
							if(_t141 == 0x20) {
								L16:
								 *0x4237a0 = 1;
								goto L17;
							}
							__eflags = _t141;
							if(_t141 != 0) {
								goto L17;
							}
							goto L16;
						}
					} else {
						goto L9;
					}
					do {
						L9:
						_t54 =  &(_t54[1]);
						__eflags =  *_t54 - 0x20;
					} while ( *_t54 == 0x20);
					goto L10;
				}
				goto L27;
			}
































                                                          0x004030e9
                                                          0x004030ed
                                                          0x004030f5
                                                          0x004030f9
                                                          0x004030fe
                                                          0x0040310e
                                                          0x00403111
                                                          0x00403118
                                                          0x0040311f
                                                          0x0040311f
                                                          0x00403118
                                                          0x00403121
                                                          0x00403126
                                                          0x00403127
                                                          0x00403133
                                                          0x00403137
                                                          0x0040313e
                                                          0x00403145
                                                          0x0040314a
                                                          0x0040314f
                                                          0x00403156
                                                          0x0040315c
                                                          0x00403172
                                                          0x00403182
                                                          0x00403187
                                                          0x0040318d
                                                          0x00403194
                                                          0x004031a7
                                                          0x004031ac
                                                          0x004031ae
                                                          0x004031b0
                                                          0x004031b5
                                                          0x004031b5
                                                          0x004031c5
                                                          0x004031cb
                                                          0x00403294
                                                          0x00403294
                                                          0x00403296
                                                          0x00403298
                                                          0x00000000
                                                          0x00000000
                                                          0x004031d4
                                                          0x004031d7
                                                          0x004031df
                                                          0x004031df
                                                          0x004031e2
                                                          0x004031e7
                                                          0x004031e9
                                                          0x004031e9
                                                          0x004031ea
                                                          0x004031ea
                                                          0x004031ef
                                                          0x004031f2
                                                          0x00403284
                                                          0x00403289
                                                          0x0040328e
                                                          0x00403291
                                                          0x00403293
                                                          0x00403293
                                                          0x00403293
                                                          0x00000000
                                                          0x004031f8
                                                          0x004031f8
                                                          0x004031f9
                                                          0x004031fc
                                                          0x00403214
                                                          0x0040323f
                                                          0x00403241
                                                          0x00403254
                                                          0x0040327f
                                                          0x00403282
                                                          0x004032a0
                                                          0x004032a3
                                                          0x004032ac
                                                          0x004032b1
                                                          0x004032b7
                                                          0x004032c2
                                                          0x004032c4
                                                          0x004032c9
                                                          0x004032cb
                                                          0x00403323
                                                          0x00403328
                                                          0x00403332
                                                          0x00403339
                                                          0x0040333d
                                                          0x004033d1
                                                          0x004033d1
                                                          0x004033d6
                                                          0x004033dc
                                                          0x004033e1
                                                          0x00403505
                                                          0x0040350b
                                                          0x00403587
                                                          0x00403587
                                                          0x0040358c
                                                          0x0040358f
                                                          0x00403591
                                                          0x00403591
                                                          0x00403599
                                                          0x00403599
                                                          0x0040351b
                                                          0x00403523
                                                          0x00403525
                                                          0x00403526
                                                          0x00403533
                                                          0x00403546
                                                          0x0040354e
                                                          0x00403552
                                                          0x00403552
                                                          0x0040355a
                                                          0x0040355f
                                                          0x00403566
                                                          0x00403574
                                                          0x00403576
                                                          0x0040357c
                                                          0x0040357e
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00403568
                                                          0x0040356e
                                                          0x00403570
                                                          0x00403572
                                                          0x00403580
                                                          0x00403582
                                                          0x00000000
                                                          0x00403582
                                                          0x00000000
                                                          0x00403572
                                                          0x00403566
                                                          0x004033f0
                                                          0x004033f7
                                                          0x004033f7
                                                          0x00403349
                                                          0x004033c1
                                                          0x004033c1
                                                          0x004033cd
                                                          0x00000000
                                                          0x004033cd
                                                          0x00403352
                                                          0x00403356
                                                          0x0040338c
                                                          0x0040338c
                                                          0x0040338e
                                                          0x00403396
                                                          0x00403408
                                                          0x0040340a
                                                          0x00403411
                                                          0x00403419
                                                          0x00403419
                                                          0x00403424
                                                          0x00403429
                                                          0x00403438
                                                          0x0040343c
                                                          0x0040343d
                                                          0x00403446
                                                          0x0040343f
                                                          0x0040343f
                                                          0x0040343f
                                                          0x0040344c
                                                          0x00403452
                                                          0x00403458
                                                          0x00403460
                                                          0x00403460
                                                          0x0040346e
                                                          0x00403473
                                                          0x00403485
                                                          0x0040348d
                                                          0x00403493
                                                          0x0040349f
                                                          0x004034a5
                                                          0x004034af
                                                          0x004034c5
                                                          0x004034d6
                                                          0x004034dc
                                                          0x004034e3
                                                          0x004034e6
                                                          0x004034ec
                                                          0x004034ec
                                                          0x004034e3
                                                          0x004034f0
                                                          0x004034f6
                                                          0x004034f6
                                                          0x004034fb
                                                          0x004034fb
                                                          0x00000000
                                                          0x00403438
                                                          0x00403398
                                                          0x0040339a
                                                          0x004033a5
                                                          0x00000000
                                                          0x00000000
                                                          0x004033ad
                                                          0x004033b8
                                                          0x004033bd
                                                          0x00000000
                                                          0x004033bd
                                                          0x00403381
                                                          0x00403383
                                                          0x00403387
                                                          0x0040338a
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040338a
                                                          0x00000000
                                                          0x00403383
                                                          0x004032d3
                                                          0x004032df
                                                          0x004032e4
                                                          0x004032e9
                                                          0x004032eb
                                                          0x00000000
                                                          0x00000000
                                                          0x004032f3
                                                          0x004032fb
                                                          0x0040330c
                                                          0x00403314
                                                          0x00403316
                                                          0x0040331b
                                                          0x0040331d
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040331d
                                                          0x00000000
                                                          0x00403282
                                                          0x00403243
                                                          0x00403246
                                                          0x00403249
                                                          0x0040324f
                                                          0x0040324f
                                                          0x0040324f
                                                          0x0040324f
                                                          0x00000000
                                                          0x0040324f
                                                          0x0040324b
                                                          0x0040324d
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040324d
                                                          0x004031fe
                                                          0x00403201
                                                          0x00403204
                                                          0x0040320a
                                                          0x0040320a
                                                          0x00000000
                                                          0x0040320a
                                                          0x00403206
                                                          0x00403208
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00403208
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x004031d9
                                                          0x004031d9
                                                          0x004031d9
                                                          0x004031da
                                                          0x004031da
                                                          0x00000000
                                                          0x004031d9
                                                          0x00000000

                                                          APIs
                                                          • SetErrorMode.KERNELBASE ref: 004030FE
                                                          • GetVersion.KERNEL32 ref: 00403104
                                                          • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 0040312D
                                                          • #17.COMCTL32(00000007,00000009), ref: 0040314F
                                                          • OleInitialize.OLE32(00000000), ref: 00403156
                                                          • SHGetFileInfoA.SHELL32(0041ECC8,00000000,?,00000160,00000000), ref: 00403172
                                                          • GetCommandLineA.KERNEL32(00422F00,NSIS Error), ref: 00403187
                                                          • GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe",00000000), ref: 0040319A
                                                          • CharNextA.USER32(00000000,"C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe",00000020), ref: 004031C5
                                                          • GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 004032C2
                                                          • GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004032D3
                                                          • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032DF
                                                          • GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032F3
                                                          • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004032FB
                                                          • SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040330C
                                                          • SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403314
                                                          • DeleteFileA.KERNELBASE(1033), ref: 00403328
                                                            • Part of subcall function 00406092: GetModuleHandleA.KERNEL32(?,?,?,00403143,00000009), ref: 004060A4
                                                            • Part of subcall function 00406092: GetProcAddress.KERNEL32(00000000,?), ref: 004060BF
                                                          • OleUninitialize.OLE32(?), ref: 004033D6
                                                          • ExitProcess.KERNEL32 ref: 004033F7
                                                          • GetCurrentProcess.KERNEL32(00000028,?), ref: 00403514
                                                          • OpenProcessToken.ADVAPI32(00000000), ref: 0040351B
                                                          • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403533
                                                          • AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00403552
                                                          • ExitWindowsEx.USER32 ref: 00403576
                                                          • ExitProcess.KERNEL32 ref: 00403599
                                                            • Part of subcall function 004054EF: MessageBoxIndirectA.USER32 ref: 0040554A
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Process$Exit$EnvironmentFileHandleModulePathTempTokenVariableWindowslstrcat$AddressAdjustCharCommandCurrentDeleteDirectoryErrorIndirectInfoInitializeLineLookupMessageModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrlen
                                                          • String ID: "$"C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe$C:\Users\user\Pacifisterne\Automatcafeer$C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
                                                          • API String ID: 3329125770-3662709379
                                                          • Opcode ID: 50a0b31070c1ea53a34a4ed8f3439128c48ee7aefbe5bb0aee2a80eb16a56470
                                                          • Instruction ID: e7c85c4fe1f62676e3f8a08d8ca43f8bf3783ba147aef7bb7f1979754dcbcc24
                                                          • Opcode Fuzzy Hash: 50a0b31070c1ea53a34a4ed8f3439128c48ee7aefbe5bb0aee2a80eb16a56470
                                                          • Instruction Fuzzy Hash: B7C1E5706083417AE711AF71AD8DA2B7EA8EB85306F04457FF541B61D2C77C5A05CB2E
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00405050 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 128 405050-40506c 129 405072-405139 GetDlgItem * 3 call 403f13 call 4047b0 GetClientRect GetSystemMetrics SendMessageA * 2 128->129 130 4051fb-405201 128->130 148 405157-40515a 129->148 149 40513b-405155 SendMessageA * 2 129->149 131 405203-405225 GetDlgItem CreateThread FindCloseChangeNotification 130->131 132 40522b-405237 130->132 131->132 134 405259-40525f 132->134 135 405239-40523f 132->135 140 405261-405267 134->140 141 4052b4-4052b7 134->141 138 405241-405254 ShowWindow * 2 call 403f13 135->138 139 40527a-405281 call 403f45 135->139 138->134 152 405286-40528a 139->152 145 405269-405275 call 403eb7 140->145 146 40528d-40529d ShowWindow 140->146 141->139 143 4052b9-4052bf 141->143 143->139 150 4052c1-4052d4 SendMessageA 143->150 145->139 153 4052ad-4052af call 403eb7 146->153 154 40529f-4052a8 call 404f12 146->154 156 40516a-405181 call 403ede 148->156 157 40515c-405168 SendMessageA 148->157 149->148 158 4053d1-4053d3 150->158 159 4052da-405306 CreatePopupMenu call 405d1b AppendMenuA 150->159 153->141 154->153 167 405183-405197 ShowWindow 156->167 168 4051b7-4051d8 GetDlgItem SendMessageA 156->168 157->156 158->152 165 405308-405318 GetWindowRect 159->165 166 40531b-405331 TrackPopupMenu 159->166 165->166 166->158 169 405337-405351 166->169 170 4051a6 167->170 171 405199-4051a4 ShowWindow 167->171 168->158 172 4051de-4051f6 SendMessageA * 2 168->172 173 405356-405371 SendMessageA 169->173 174 4051ac-4051b2 call 403f13 170->174 171->174 172->158 173->173 175 405373-405393 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 173->175 174->168 177 405395-4053b5 SendMessageA 175->177 177->177 178 4053b7-4053cb GlobalUnlock SetClipboardData CloseClipboard 177->178 178->158
                                                          C-Code - Quality: 96%
                                                          			E00405050(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				struct tagRECT _v24;
				void* _v32;
				signed int _v36;
				int _v40;
				int _v44;
				signed int _v48;
				int _v52;
				void* _v56;
				void* _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t87;
				struct HWND__* _t89;
				long _t90;
				int _t95;
				int _t96;
				long _t99;
				void* _t102;
				intOrPtr _t113;
				void* _t121;
				intOrPtr _t124;
				struct HWND__* _t128;
				int _t150;
				int _t153;
				long _t157;
				struct HWND__* _t161;
				struct HMENU__* _t163;
				long _t165;
				void* _t166;
				char* _t167;
				char* _t168;
				int _t169;

				_t87 =  *0x422ee4; // 0x10434
				_t157 = _a8;
				_t150 = 0;
				_v8 = _t87;
				if(_t157 != 0x110) {
					__eflags = _t157 - 0x405;
					if(_t157 == 0x405) {
						_t121 = CreateThread(0, 0, E00404FE4, GetDlgItem(_a4, 0x3ec), 0,  &_a8); // executed
						FindCloseChangeNotification(_t121);
					}
					__eflags = _t157 - 0x111;
					if(_t157 != 0x111) {
						L17:
						__eflags = _t157 - 0x404;
						if(_t157 != 0x404) {
							L25:
							__eflags = _t157 - 0x7b;
							if(_t157 != 0x7b) {
								goto L20;
							}
							_t89 = _v8;
							__eflags = _a12 - _t89;
							if(_a12 != _t89) {
								goto L20;
							}
							_t90 = SendMessageA(_t89, 0x1004, _t150, _t150);
							__eflags = _t90 - _t150;
							_a12 = _t90;
							if(_t90 <= _t150) {
								L36:
								return 0;
							}
							_t163 = CreatePopupMenu();
							AppendMenuA(_t163, _t150, 1, E00405D1B(_t150, _t157, _t163, _t150, 0xffffffe1));
							_t95 = _a16;
							__eflags = _a16 - 0xffffffff;
							_t153 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v24);
								_t95 = _v24.left;
								_t153 = _v24.top;
							}
							_t96 = TrackPopupMenu(_t163, 0x180, _t95, _t153, _t150, _a4, _t150);
							__eflags = _t96 - 1;
							if(_t96 == 1) {
								_t165 = 1;
								__eflags = 1;
								_v56 = _t150;
								_v44 = 0x41fd08;
								_v40 = 0x1000;
								_a4 = _a12;
								do {
									_a4 = _a4 - 1;
									_t99 = SendMessageA(_v8, 0x102d, _a4,  &_v64);
									__eflags = _a4 - _t150;
									_t165 = _t165 + _t99 + 2;
								} while (_a4 != _t150);
								OpenClipboard(_t150);
								EmptyClipboard();
								_t102 = GlobalAlloc(0x42, _t165);
								_a4 = _t102;
								_t166 = GlobalLock(_t102);
								do {
									_v44 = _t166;
									_t167 = _t166 + SendMessageA(_v8, 0x102d, _t150,  &_v64);
									 *_t167 = 0xd;
									_t168 = _t167 + 1;
									 *_t168 = 0xa;
									_t166 = _t168 + 1;
									_t150 = _t150 + 1;
									__eflags = _t150 - _a12;
								} while (_t150 < _a12);
								GlobalUnlock(_a4);
								SetClipboardData(1, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						__eflags =  *0x422ecc - _t150; // 0x0
						if(__eflags == 0) {
							ShowWindow( *0x423708, 8);
							__eflags =  *0x42378c - _t150;
							if( *0x42378c == _t150) {
								_t113 =  *0x41f4e0; // 0x5f90ec
								E00404F12( *((intOrPtr*)(_t113 + 0x34)), _t150);
							}
							E00403EB7(1);
							goto L25;
						}
						 *0x41f0d8 = 2;
						E00403EB7(0x78);
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E00403F45(_t157, _a12, _a16);
						}
						ShowWindow( *0x422ed0, _t150);
						ShowWindow(_v8, 8);
						E00403F13(_v8);
						goto L17;
					}
				}
				_v48 = _v48 | 0xffffffff;
				_v36 = _v36 | 0xffffffff;
				_t169 = 2;
				_v56 = _t169;
				_v52 = 0;
				_v44 = 0;
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				_t124 =  *0x423710;
				_a12 =  *((intOrPtr*)(_t124 + 0x5c));
				_a8 =  *((intOrPtr*)(_t124 + 0x60));
				 *0x422ed0 = GetDlgItem(_a4, 0x403);
				 *0x422ec8 = GetDlgItem(_a4, 0x3ee);
				_t128 = GetDlgItem(_a4, 0x3f8);
				 *0x422ee4 = _t128;
				_v8 = _t128;
				E00403F13( *0x422ed0);
				 *0x422ed4 = E004047B0(4);
				 *0x422eec = 0;
				GetClientRect(_v8,  &_v24);
				_v48 = _v24.right - GetSystemMetrics(_t169);
				SendMessageA(_v8, 0x101b, 0,  &_v56); // executed
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000); // executed
				if(_a12 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a12);
					SendMessageA(_v8, 0x1026, 0, _a12);
				}
				if(_a8 >= _t150) {
					SendMessageA(_v8, 0x1024, _t150, _a8);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00403EDE(_a4);
				if(( *0x423718 & 0x00000003) != 0) {
					ShowWindow( *0x422ed0, _t150);
					if(( *0x423718 & 0x00000002) != 0) {
						 *0x422ed0 = _t150;
					} else {
						ShowWindow(_v8, 8);
					}
					E00403F13( *0x422ec8);
				}
				_t161 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t161, 0x401, _t150, 0x75300000);
				if(( *0x423718 & 0x00000004) != 0) {
					SendMessageA(_t161, 0x409, _t150, _a8);
					SendMessageA(_t161, 0x2001, _t150, _a12);
				}
				goto L36;
			}





































                                                          0x00405056
                                                          0x0040505e
                                                          0x00405061
                                                          0x00405069
                                                          0x0040506c
                                                          0x004051fb
                                                          0x00405201
                                                          0x0040521e
                                                          0x00405225
                                                          0x00405225
                                                          0x00405231
                                                          0x00405237
                                                          0x00405259
                                                          0x00405259
                                                          0x0040525f
                                                          0x004052b4
                                                          0x004052b4
                                                          0x004052b7
                                                          0x00000000
                                                          0x00000000
                                                          0x004052b9
                                                          0x004052bc
                                                          0x004052bf
                                                          0x00000000
                                                          0x00000000
                                                          0x004052c9
                                                          0x004052cf
                                                          0x004052d1
                                                          0x004052d4
                                                          0x004053d1
                                                          0x00000000
                                                          0x004053d1
                                                          0x004052e3
                                                          0x004052ef
                                                          0x004052f8
                                                          0x004052ff
                                                          0x00405303
                                                          0x00405306
                                                          0x0040530f
                                                          0x00405315
                                                          0x00405318
                                                          0x00405318
                                                          0x00405328
                                                          0x0040532e
                                                          0x00405331
                                                          0x0040533c
                                                          0x0040533c
                                                          0x0040533d
                                                          0x00405340
                                                          0x00405347
                                                          0x0040534e
                                                          0x00405356
                                                          0x00405356
                                                          0x00405364
                                                          0x0040536a
                                                          0x0040536d
                                                          0x0040536d
                                                          0x00405374
                                                          0x0040537a
                                                          0x00405383
                                                          0x0040538a
                                                          0x00405393
                                                          0x00405395
                                                          0x00405398
                                                          0x004053a7
                                                          0x004053a9
                                                          0x004053ac
                                                          0x004053ad
                                                          0x004053b0
                                                          0x004053b1
                                                          0x004053b2
                                                          0x004053b2
                                                          0x004053ba
                                                          0x004053c5
                                                          0x004053cb
                                                          0x004053cb
                                                          0x00000000
                                                          0x00405331
                                                          0x00405261
                                                          0x00405267
                                                          0x00405295
                                                          0x00405297
                                                          0x0040529d
                                                          0x0040529f
                                                          0x004052a8
                                                          0x004052a8
                                                          0x004052af
                                                          0x00000000
                                                          0x004052af
                                                          0x0040526b
                                                          0x00405275
                                                          0x00000000
                                                          0x00405239
                                                          0x00405239
                                                          0x0040523f
                                                          0x0040527a
                                                          0x00000000
                                                          0x00405281
                                                          0x00405248
                                                          0x0040524f
                                                          0x00405254
                                                          0x00000000
                                                          0x00405254
                                                          0x00405237
                                                          0x00405072
                                                          0x00405076
                                                          0x0040507e
                                                          0x00405082
                                                          0x00405085
                                                          0x00405088
                                                          0x0040508b
                                                          0x0040508e
                                                          0x0040508f
                                                          0x00405090
                                                          0x004050a9
                                                          0x004050ac
                                                          0x004050b6
                                                          0x004050c5
                                                          0x004050cd
                                                          0x004050d5
                                                          0x004050da
                                                          0x004050dd
                                                          0x004050e9
                                                          0x004050f2
                                                          0x004050fb
                                                          0x0040511d
                                                          0x00405123
                                                          0x00405134
                                                          0x00405139
                                                          0x00405147
                                                          0x00405155
                                                          0x00405155
                                                          0x0040515a
                                                          0x00405168
                                                          0x00405168
                                                          0x0040516d
                                                          0x00405170
                                                          0x00405175
                                                          0x00405181
                                                          0x0040518a
                                                          0x00405197
                                                          0x004051a6
                                                          0x00405199
                                                          0x0040519e
                                                          0x0040519e
                                                          0x004051b2
                                                          0x004051b2
                                                          0x004051c6
                                                          0x004051cf
                                                          0x004051d8
                                                          0x004051e8
                                                          0x004051f4
                                                          0x004051f4
                                                          0x00000000

                                                          APIs
                                                          Strings
                                                          • Staalbrylluppets Setup: Installing, xrefs: 00405340
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendChangeClientDataEmptyFindLockMetricsNotificationOpenSystemThreadTrackUnlock
                                                          • String ID: Staalbrylluppets Setup: Installing
                                                          • API String ID: 4154960007-4054940716
                                                          • Opcode ID: 848e6ad2b3afedd67cc7e117b643057e124365ea868e6e10ce1dc79c30623e5c
                                                          • Instruction ID: 36ba5585b1d224b9782629df23ee11add298fe1a6f2e37662bad4ed6ffe984ff
                                                          • Opcode Fuzzy Hash: 848e6ad2b3afedd67cc7e117b643057e124365ea868e6e10ce1dc79c30623e5c
                                                          • Instruction Fuzzy Hash: 46A159B1900208BFDB119FA0DD85AAE7F79FB48355F10407AFA01B61A0C7B55E41DF69
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00405D1B Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 199stringCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 422 405d1b-405d26 423 405d28-405d37 422->423 424 405d39-405d4e 422->424 423->424 425 405f41-405f45 424->425 426 405d54-405d5f 424->426 427 405d71-405d7b 425->427 428 405f4b-405f55 425->428 426->425 429 405d65-405d6c 426->429 427->428 432 405d81-405d88 427->432 430 405f60-405f61 428->430 431 405f57-405f5b call 405cf9 428->431 429->425 431->430 433 405f34 432->433 434 405d8e-405dc3 432->434 436 405f36-405f3c 433->436 437 405f3e-405f40 433->437 438 405dc9-405dd4 GetVersion 434->438 439 405ede-405ee1 434->439 436->425 437->425 440 405dd6-405dda 438->440 441 405dee 438->441 442 405f11-405f14 439->442 443 405ee3-405ee6 439->443 440->441 444 405ddc-405de0 440->444 447 405df5-405dfc 441->447 448 405f22-405f32 lstrlenA 442->448 449 405f16-405f1d call 405d1b 442->449 445 405ef6-405f02 call 405cf9 443->445 446 405ee8-405ef4 call 405c57 443->446 444->441 450 405de2-405de6 444->450 460 405f07-405f0d 445->460 446->460 452 405e01-405e03 447->452 453 405dfe-405e00 447->453 448->425 449->448 450->441 456 405de8-405dec 450->456 458 405e05-405e20 call 405be0 452->458 459 405e3c-405e3f 452->459 453->452 456->447 468 405e25-405e28 458->468 461 405e41-405e4d GetSystemDirectoryA 459->461 462 405e4f-405e52 459->462 460->448 464 405f0f 460->464 465 405ec0-405ec3 461->465 466 405e54-405e62 GetWindowsDirectoryA 462->466 467 405ebc-405ebe 462->467 469 405ed6-405edc call 405f64 464->469 465->469 472 405ec5-405ec9 465->472 466->467 467->465 471 405e64-405e6e 467->471 468->472 473 405e2e-405e37 call 405d1b 468->473 469->448 475 405e70-405e73 471->475 476 405e88-405e9e SHGetSpecialFolderLocation 471->476 472->469 478 405ecb-405ed1 lstrcatA 472->478 473->465 475->476 479 405e75-405e7c 475->479 480 405ea0-405eb7 SHGetPathFromIDListA CoTaskMemFree 476->480 481 405eb9 476->481 478->469 483 405e84-405e86 479->483 480->465 480->481 481->467 483->465 483->476
                                                          C-Code - Quality: 74%
                                                          			E00405D1B(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				signed char _v28;
				signed int _t37;
				CHAR* _t38;
				signed int _t40;
				int _t41;
				char _t51;
				char _t52;
				char _t54;
				char _t56;
				void* _t64;
				signed int _t70;
				signed int _t75;
				signed int _t76;
				intOrPtr _t80;
				char _t82;
				void* _t86;
				CHAR* _t87;
				void* _t89;
				signed int _t96;
				signed int _t98;
				void* _t99;

				_t89 = __esi;
				_t86 = __edi;
				_t64 = __ebx;
				_t37 = _a8;
				if(_t37 < 0) {
					_t80 =  *0x422edc; // 0x5fcb61
					_t37 =  *(_t80 - 4 + _t37 * 4);
				}
				_push(_t64);
				_t75 =  *0x423738 + _t37;
				_t38 = 0x4226a0;
				_push(_t89);
				_push(_t86);
				_t87 = 0x4226a0;
				if(_a4 >= 0x4226a0 && _a4 - 0x4226a0 < 0x800) {
					_t87 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t82 =  *_t75;
					if(_t82 == 0) {
						break;
					}
					__eflags = _t87 - _t38 - 0x400;
					if(_t87 - _t38 >= 0x400) {
						break;
					}
					_t75 = _t75 + 1;
					__eflags = _t82 - 4;
					_a8 = _t75;
					if(__eflags >= 0) {
						if(__eflags != 0) {
							 *_t87 = _t82;
							_t87 =  &(_t87[1]);
							__eflags = _t87;
						} else {
							 *_t87 =  *_t75;
							_t87 =  &(_t87[1]);
							_t75 = _t75 + 1;
						}
						continue;
					}
					_t40 =  *(_t75 + 1);
					_t76 =  *_t75;
					_t96 = (_t40 & 0x0000007f) << 0x00000007 | _t76 & 0x0000007f;
					_a8 = _a8 + 2;
					_v28 = _t76 | 0x00000080;
					_t70 = _t76;
					_v24 = _t70;
					__eflags = _t82 - 2;
					_v20 = _t40 | 0x00000080;
					_v16 = _t40;
					if(_t82 != 2) {
						__eflags = _t82 - 3;
						if(_t82 != 3) {
							__eflags = _t82 - 1;
							if(_t82 == 1) {
								__eflags = (_t40 | 0xffffffff) - _t96;
								E00405D1B(_t70, _t87, _t96, _t87, (_t40 | 0xffffffff) - _t96);
							}
							L42:
							_t41 = lstrlenA(_t87);
							_t75 = _a8;
							_t87 =  &(_t87[_t41]);
							_t38 = 0x4226a0;
							continue;
						}
						__eflags = _t96 - 0x1d;
						if(_t96 != 0x1d) {
							__eflags = (_t96 << 0xa) + 0x424000;
							E00405CF9(_t87, (_t96 << 0xa) + 0x424000);
						} else {
							E00405C57(_t87,  *0x423708);
						}
						__eflags = _t96 + 0xffffffeb - 7;
						if(_t96 + 0xffffffeb < 7) {
							L33:
							E00405F64(_t87);
						}
						goto L42;
					}
					_t98 = 2;
					_t51 = GetVersion();
					__eflags = _t51;
					if(_t51 >= 0) {
						L13:
						_v8 = 1;
						L14:
						__eflags =  *0x423784;
						if( *0x423784 != 0) {
							_t98 = 4;
						}
						__eflags = _t70;
						if(_t70 >= 0) {
							__eflags = _t70 - 0x25;
							if(_t70 != 0x25) {
								__eflags = _t70 - 0x24;
								if(_t70 == 0x24) {
									GetWindowsDirectoryA(_t87, 0x400);
									_t98 = 0;
								}
								while(1) {
									__eflags = _t98;
									if(_t98 == 0) {
										goto L30;
									}
									_t52 =  *0x423704;
									_t98 = _t98 - 1;
									__eflags = _t52;
									if(_t52 == 0) {
										L26:
										_t54 = SHGetSpecialFolderLocation( *0x423708,  *(_t99 + _t98 * 4 - 0x18),  &_v12);
										__eflags = _t54;
										if(_t54 != 0) {
											L28:
											 *_t87 =  *_t87 & 0x00000000;
											__eflags =  *_t87;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v12, _t87);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t54;
										if(_t54 != 0) {
											goto L30;
										}
										goto L28;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L26;
									}
									_t56 =  *_t52( *0x423708,  *(_t99 + _t98 * 4 - 0x18), 0, 0, _t87); // executed
									__eflags = _t56;
									if(_t56 == 0) {
										goto L30;
									}
									goto L26;
								}
								goto L30;
							}
							GetSystemDirectoryA(_t87, 0x400);
							goto L30;
						} else {
							_t73 = (_t70 & 0x0000003f) +  *0x423738;
							E00405BE0(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t70 & 0x0000003f) +  *0x423738, _t87, _t70 & 0x00000040); // executed
							__eflags =  *_t87;
							if( *_t87 != 0) {
								L31:
								__eflags = _v16 - 0x1a;
								if(_v16 == 0x1a) {
									lstrcatA(_t87, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L33;
							}
							E00405D1B(_t73, _t87, _t98, _t87, _v16);
							L30:
							__eflags =  *_t87;
							if( *_t87 == 0) {
								goto L33;
							}
							goto L31;
						}
					}
					__eflags = _t51 - 0x5a04;
					if(_t51 == 0x5a04) {
						goto L13;
					}
					__eflags = _v16 - 0x23;
					if(_v16 == 0x23) {
						goto L13;
					}
					__eflags = _v16 - 0x2e;
					if(_v16 == 0x2e) {
						goto L13;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L14;
					}
				}
				 *_t87 =  *_t87 & 0x00000000;
				if(_a4 == 0) {
					return _t38;
				}
				return E00405CF9(_a4, _t38);
			}





























                                                          0x00405d1b
                                                          0x00405d1b
                                                          0x00405d1b
                                                          0x00405d21
                                                          0x00405d26
                                                          0x00405d28
                                                          0x00405d37
                                                          0x00405d37
                                                          0x00405d3f
                                                          0x00405d40
                                                          0x00405d42
                                                          0x00405d4a
                                                          0x00405d4b
                                                          0x00405d4c
                                                          0x00405d4e
                                                          0x00405d65
                                                          0x00405d68
                                                          0x00405d68
                                                          0x00405f41
                                                          0x00405f41
                                                          0x00405f45
                                                          0x00000000
                                                          0x00000000
                                                          0x00405d75
                                                          0x00405d7b
                                                          0x00000000
                                                          0x00000000
                                                          0x00405d81
                                                          0x00405d82
                                                          0x00405d85
                                                          0x00405d88
                                                          0x00405f34
                                                          0x00405f3e
                                                          0x00405f40
                                                          0x00405f40
                                                          0x00405f36
                                                          0x00405f38
                                                          0x00405f3a
                                                          0x00405f3b
                                                          0x00405f3b
                                                          0x00000000
                                                          0x00405f34
                                                          0x00405d8e
                                                          0x00405d92
                                                          0x00405da2
                                                          0x00405da6
                                                          0x00405dad
                                                          0x00405db0
                                                          0x00405db4
                                                          0x00405dba
                                                          0x00405dbd
                                                          0x00405dc0
                                                          0x00405dc3
                                                          0x00405ede
                                                          0x00405ee1
                                                          0x00405f11
                                                          0x00405f14
                                                          0x00405f19
                                                          0x00405f1d
                                                          0x00405f1d
                                                          0x00405f22
                                                          0x00405f23
                                                          0x00405f28
                                                          0x00405f2b
                                                          0x00405f2d
                                                          0x00000000
                                                          0x00405f2d
                                                          0x00405ee3
                                                          0x00405ee6
                                                          0x00405efb
                                                          0x00405f02
                                                          0x00405ee8
                                                          0x00405eef
                                                          0x00405eef
                                                          0x00405f0a
                                                          0x00405f0d
                                                          0x00405ed6
                                                          0x00405ed7
                                                          0x00405ed7
                                                          0x00000000
                                                          0x00405f0d
                                                          0x00405dcb
                                                          0x00405dcc
                                                          0x00405dd2
                                                          0x00405dd4
                                                          0x00405dee
                                                          0x00405dee
                                                          0x00405df5
                                                          0x00405df5
                                                          0x00405dfc
                                                          0x00405e00
                                                          0x00405e00
                                                          0x00405e01
                                                          0x00405e03
                                                          0x00405e3c
                                                          0x00405e3f
                                                          0x00405e4f
                                                          0x00405e52
                                                          0x00405e5a
                                                          0x00405e60
                                                          0x00405e60
                                                          0x00405ebc
                                                          0x00405ebc
                                                          0x00405ebe
                                                          0x00000000
                                                          0x00000000
                                                          0x00405e64
                                                          0x00405e6b
                                                          0x00405e6c
                                                          0x00405e6e
                                                          0x00405e88
                                                          0x00405e96
                                                          0x00405e9c
                                                          0x00405e9e
                                                          0x00405eb9
                                                          0x00405eb9
                                                          0x00405eb9
                                                          0x00000000
                                                          0x00405eb9
                                                          0x00405ea4
                                                          0x00405eaf
                                                          0x00405eb5
                                                          0x00405eb7
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00405eb7
                                                          0x00405e70
                                                          0x00405e73
                                                          0x00000000
                                                          0x00000000
                                                          0x00405e82
                                                          0x00405e84
                                                          0x00405e86
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00405e86
                                                          0x00000000
                                                          0x00405ebc
                                                          0x00405e47
                                                          0x00000000
                                                          0x00405e05
                                                          0x00405e0a
                                                          0x00405e20
                                                          0x00405e25
                                                          0x00405e28
                                                          0x00405ec5
                                                          0x00405ec5
                                                          0x00405ec9
                                                          0x00405ed1
                                                          0x00405ed1
                                                          0x00000000
                                                          0x00405ec9
                                                          0x00405e32
                                                          0x00405ec0
                                                          0x00405ec0
                                                          0x00405ec3
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00405ec3
                                                          0x00405e03
                                                          0x00405dd6
                                                          0x00405dda
                                                          0x00000000
                                                          0x00000000
                                                          0x00405ddc
                                                          0x00405de0
                                                          0x00000000
                                                          0x00000000
                                                          0x00405de2
                                                          0x00405de6
                                                          0x00000000
                                                          0x00405de8
                                                          0x00405de8
                                                          0x00000000
                                                          0x00405de8
                                                          0x00405de6
                                                          0x00405f4b
                                                          0x00405f55
                                                          0x00405f61
                                                          0x00405f61
                                                          0x00000000

                                                          APIs
                                                          • GetVersion.KERNEL32(?,Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,00000000,00404F4A,Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,00000000), ref: 00405DCC
                                                          • GetSystemDirectoryA.KERNEL32 ref: 00405E47
                                                          • GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405E5A
                                                          • SHGetSpecialFolderLocation.SHELL32(?,0040E8C0), ref: 00405E96
                                                          • SHGetPathFromIDListA.SHELL32(0040E8C0,Call), ref: 00405EA4
                                                          • CoTaskMemFree.OLE32(0040E8C0), ref: 00405EAF
                                                          • lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405ED1
                                                          • lstrlenA.KERNEL32(Call,?,Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,00000000,00404F4A,Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,00000000), ref: 00405F23
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
                                                          • String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                          • API String ID: 900638850-3045280587
                                                          • Opcode ID: e57bde13a3ce28464dd087e4cc926d744cd5fee8b1e2ea9ac4f193307b0a4faa
                                                          • Instruction ID: 70d043a0125fa0970afc212ad974551980140434863585fcf13b89b4fbf53fe2
                                                          • Opcode Fuzzy Hash: e57bde13a3ce28464dd087e4cc926d744cd5fee8b1e2ea9ac4f193307b0a4faa
                                                          • Instruction Fuzzy Hash: AD61F471A04A01ABDF205F64DC88B7F3BA8DB41305F50803BE941B62D0D27D4A82DF5E
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040559B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159filestringCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 484 40559b-4055c1 call 405859 487 4055c3-4055d5 DeleteFileA 484->487 488 4055da-4055e1 484->488 489 405764-405768 487->489 490 4055e3-4055e5 488->490 491 4055f4-405604 call 405cf9 488->491 492 405712-405717 490->492 493 4055eb-4055ee 490->493 497 405613-405614 call 4057b2 491->497 498 405606-405611 lstrcatA 491->498 492->489 496 405719-40571c 492->496 493->491 493->492 499 405726-40572e call 405ffd 496->499 500 40571e-405724 496->500 501 405619-40561c 497->501 498->501 499->489 508 405730-405744 call 40576b call 405553 499->508 500->489 504 405627-40562d lstrcatA 501->504 505 40561e-405625 501->505 507 405632-405650 lstrlenA FindFirstFileA 504->507 505->504 505->507 509 405656-40566d call 405796 507->509 510 405708-40570c 507->510 520 405746-405749 508->520 521 40575c-40575f call 404f12 508->521 518 405678-40567b 509->518 519 40566f-405673 509->519 510->492 513 40570e 510->513 513->492 523 40567d-405682 518->523 524 40568e-40569c call 405cf9 518->524 519->518 522 405675 519->522 520->500 526 40574b-40575a call 404f12 call 405bb4 520->526 521->489 522->518 528 405684-405686 523->528 529 4056e7-4056f9 FindNextFileA 523->529 534 4056b3-4056be call 405553 524->534 535 40569e-4056a6 524->535 526->489 528->524 530 405688-40568c 528->530 529->509 533 4056ff-405702 FindClose 529->533 530->524 530->529 533->510 544 4056c0-4056c3 534->544 545 4056df-4056e2 call 404f12 534->545 535->529 537 4056a8-4056b1 call 40559b 535->537 537->529 547 4056c5-4056d5 call 404f12 call 405bb4 544->547 548 4056d7-4056dd 544->548 545->529 547->529 548->529
                                                          C-Code - Quality: 98%
                                                          			E0040559B(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				signed int _v16;
				struct _WIN32_FIND_DATAA _v336;
				signed int _t40;
				char* _t53;
				signed int _t55;
				signed int _t58;
				signed int _t64;
				signed int _t66;
				void* _t68;
				signed char _t69;
				CHAR* _t71;
				void* _t72;
				CHAR* _t73;
				char* _t76;

				_t69 = _a8;
				_t73 = _a4;
				_v8 = _t69 & 0x00000004;
				_t40 = E00405859(__eflags, _t73);
				_v16 = _t40;
				if((_t69 & 0x00000008) != 0) {
					_t66 = DeleteFileA(_t73); // executed
					asm("sbb eax, eax");
					_t68 =  ~_t66 + 1;
					 *0x423788 =  *0x423788 + _t68;
					return _t68;
				}
				_a4 = _t69;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E00405CF9(0x420d10, _t73);
					__eflags = _a4;
					if(_a4 == 0) {
						E004057B2(_t73);
					} else {
						lstrcatA(0x420d10, "\*.*");
					}
					__eflags =  *_t73;
					if( *_t73 != 0) {
						L10:
						lstrcatA(_t73, 0x409014);
						L11:
						_t71 =  &(_t73[lstrlenA(_t73)]);
						_t40 = FindFirstFileA(0x420d10,  &_v336);
						__eflags = _t40 - 0xffffffff;
						_v12 = _t40;
						if(_t40 == 0xffffffff) {
							L29:
							__eflags = _a4;
							if(_a4 != 0) {
								_t32 = _t71 - 1;
								 *_t32 =  *(_t71 - 1) & 0x00000000;
								__eflags =  *_t32;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t76 =  &(_v336.cFileName);
							_t53 = E00405796( &(_v336.cFileName), 0x3f);
							__eflags =  *_t53;
							if( *_t53 != 0) {
								__eflags = _v336.cAlternateFileName;
								if(_v336.cAlternateFileName != 0) {
									_t76 =  &(_v336.cAlternateFileName);
								}
							}
							__eflags =  *_t76 - 0x2e;
							if( *_t76 != 0x2e) {
								L19:
								E00405CF9(_t71, _t76);
								__eflags = _v336.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t55 = E00405553(__eflags, _t73, _v8);
									__eflags = _t55;
									if(_t55 != 0) {
										E00404F12(0xfffffff2, _t73);
									} else {
										__eflags = _v8 - _t55;
										if(_v8 == _t55) {
											 *0x423788 =  *0x423788 + 1;
										} else {
											E00404F12(0xfffffff1, _t73);
											E00405BB4(_t72, _t73, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E0040559B(__eflags, _t73, _a8);
									}
								}
								goto L27;
							}
							_t64 =  *((intOrPtr*)(_t76 + 1));
							__eflags = _t64;
							if(_t64 == 0) {
								goto L27;
							}
							__eflags = _t64 - 0x2e;
							if(_t64 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t76 + 2));
							if( *((char*)(_t76 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t58 = FindNextFileA(_v12,  &_v336);
							__eflags = _t58;
						} while (_t58 != 0);
						_t40 = FindClose(_v12);
						goto L29;
					}
					__eflags =  *0x420d10 - 0x5c;
					if( *0x420d10 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t40;
					if(_t40 == 0) {
						L31:
						__eflags = _a4;
						if(_a4 == 0) {
							L39:
							return _t40;
						}
						__eflags = _v16;
						if(_v16 != 0) {
							_t40 = E00405FFD(_t73);
							__eflags = _t40;
							if(_t40 == 0) {
								goto L39;
							}
							E0040576B(_t73);
							_t40 = E00405553(__eflags, _t73, _v8 | 0x00000001);
							__eflags = _t40;
							if(_t40 != 0) {
								return E00404F12(0xffffffe5, _t73);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L33;
							}
							E00404F12(0xfffffff1, _t73);
							return E00405BB4(_t72, _t73, 0);
						}
						L33:
						 *0x423788 =  *0x423788 + 1;
						return _t40;
					}
					__eflags = _t69 & 0x00000002;
					if((_t69 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}



















                                                          0x004055a5
                                                          0x004055aa
                                                          0x004055b3
                                                          0x004055b6
                                                          0x004055be
                                                          0x004055c1
                                                          0x004055c4
                                                          0x004055cc
                                                          0x004055ce
                                                          0x004055cf
                                                          0x00000000
                                                          0x004055cf
                                                          0x004055da
                                                          0x004055dd
                                                          0x004055dd
                                                          0x004055dd
                                                          0x004055e1
                                                          0x004055f4
                                                          0x004055fb
                                                          0x00405600
                                                          0x00405604
                                                          0x00405614
                                                          0x00405606
                                                          0x0040560c
                                                          0x0040560c
                                                          0x00405619
                                                          0x0040561c
                                                          0x00405627
                                                          0x0040562d
                                                          0x00405632
                                                          0x00405642
                                                          0x00405644
                                                          0x0040564a
                                                          0x0040564d
                                                          0x00405650
                                                          0x00405708
                                                          0x00405708
                                                          0x0040570c
                                                          0x0040570e
                                                          0x0040570e
                                                          0x0040570e
                                                          0x0040570e
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00405656
                                                          0x00405656
                                                          0x0040565f
                                                          0x00405665
                                                          0x0040566a
                                                          0x0040566d
                                                          0x0040566f
                                                          0x00405673
                                                          0x00405675
                                                          0x00405675
                                                          0x00405673
                                                          0x00405678
                                                          0x0040567b
                                                          0x0040568e
                                                          0x00405690
                                                          0x00405695
                                                          0x0040569c
                                                          0x004056b7
                                                          0x004056bc
                                                          0x004056be
                                                          0x004056e2
                                                          0x004056c0
                                                          0x004056c0
                                                          0x004056c3
                                                          0x004056d7
                                                          0x004056c5
                                                          0x004056c8
                                                          0x004056d0
                                                          0x004056d0
                                                          0x004056c3
                                                          0x0040569e
                                                          0x004056a4
                                                          0x004056a6
                                                          0x004056ac
                                                          0x004056ac
                                                          0x004056a6
                                                          0x00000000
                                                          0x0040569c
                                                          0x0040567d
                                                          0x00405680
                                                          0x00405682
                                                          0x00000000
                                                          0x00000000
                                                          0x00405684
                                                          0x00405686
                                                          0x00000000
                                                          0x00000000
                                                          0x00405688
                                                          0x0040568c
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x004056e7
                                                          0x004056f1
                                                          0x004056f7
                                                          0x004056f7
                                                          0x00405702
                                                          0x00000000
                                                          0x00405702
                                                          0x0040561e
                                                          0x00405625
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x004055e3
                                                          0x004055e3
                                                          0x004055e5
                                                          0x00405712
                                                          0x00405714
                                                          0x00405717
                                                          0x00405768
                                                          0x00405768
                                                          0x00405768
                                                          0x00405719
                                                          0x0040571c
                                                          0x00405727
                                                          0x0040572c
                                                          0x0040572e
                                                          0x00000000
                                                          0x00000000
                                                          0x00405731
                                                          0x0040573d
                                                          0x00405742
                                                          0x00405744
                                                          0x00000000
                                                          0x0040575f
                                                          0x00405746
                                                          0x00405749
                                                          0x00000000
                                                          0x00000000
                                                          0x0040574e
                                                          0x00000000
                                                          0x00405755
                                                          0x0040571e
                                                          0x0040571e
                                                          0x00000000
                                                          0x0040571e
                                                          0x004055eb
                                                          0x004055ee
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x004055ee

                                                          APIs
                                                          • DeleteFileA.KERNELBASE(?,?,74D0FA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004055C4
                                                          • lstrcatA.KERNEL32(00420D10,\*.*,00420D10,?,?,74D0FA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040560C
                                                          • lstrcatA.KERNEL32(?,00409014,?,00420D10,?,?,74D0FA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040562D
                                                          • lstrlenA.KERNEL32(?,?,00409014,?,00420D10,?,?,74D0FA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405633
                                                          • FindFirstFileA.KERNEL32(00420D10,?,?,?,00409014,?,00420D10,?,?,74D0FA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405644
                                                          • FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004056F1
                                                          • FindClose.KERNEL32(00000000), ref: 00405702
                                                          Strings
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 004055A8
                                                          • \*.*, xrefs: 00405606
                                                          • "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe", xrefs: 0040559B
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                          • String ID: "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe"$C:\Users\user\AppData\Local\Temp\$\*.*
                                                          • API String ID: 2035342205-2768914169
                                                          • Opcode ID: 4945869a0ddb89a28df30a02b37ec52cfc40d2726b5cdb6bcb57fc33eba49791
                                                          • Instruction ID: 44541a5d5af4c0b2911f4644f2fa5328a4f1ed3919081d24b86541679c9c03d6
                                                          • Opcode Fuzzy Hash: 4945869a0ddb89a28df30a02b37ec52cfc40d2726b5cdb6bcb57fc33eba49791
                                                          • Instruction Fuzzy Hash: 9F51CF30804A04BADF217A658C85BBF7AB8DF82318F54847BF445761D2C73D4982EE6E
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00406344 Relevance: 5.4, APIs: 4, Instructions: 382COMMONCrypto
                                                          Download Yara Rule
                                                          C-Code - Quality: 98%
                                                          			E00406344() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M00406BE7))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4)); // executed
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8)); // executed
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}













                                                          0x00000000
                                                          0x00406344
                                                          0x00406344
                                                          0x00406349
                                                          0x004063c0
                                                          0x004063c7
                                                          0x004063d1
                                                          0x004069b0
                                                          0x004069b0
                                                          0x004069b3
                                                          0x004069b3
                                                          0x004069b9
                                                          0x004069bf
                                                          0x004069c5
                                                          0x004069df
                                                          0x004069e2
                                                          0x004069e8
                                                          0x004069f3
                                                          0x004069f5
                                                          0x004069c7
                                                          0x004069c7
                                                          0x004069d6
                                                          0x004069da
                                                          0x004069da
                                                          0x004069ff
                                                          0x00406a26
                                                          0x00406a26
                                                          0x00406a2c
                                                          0x00406a2c
                                                          0x00000000
                                                          0x00406a01
                                                          0x00406a01
                                                          0x00406a05
                                                          0x00406bb4
                                                          0x00000000
                                                          0x00406bb4
                                                          0x00406a11
                                                          0x00406a18
                                                          0x00406a20
                                                          0x00406a23
                                                          0x00000000
                                                          0x00406a23
                                                          0x0040634b
                                                          0x0040634b
                                                          0x0040634f
                                                          0x00406357
                                                          0x0040635a
                                                          0x0040635c
                                                          0x0040635f
                                                          0x00406361
                                                          0x00406366
                                                          0x00406369
                                                          0x00406370
                                                          0x00406377
                                                          0x0040637a
                                                          0x00406385
                                                          0x0040638d
                                                          0x0040638d
                                                          0x00406387
                                                          0x00406387
                                                          0x00406387
                                                          0x0040637c
                                                          0x0040637c
                                                          0x0040637c
                                                          0x00406394
                                                          0x004063b2
                                                          0x004063b4
                                                          0x00406587
                                                          0x00406587
                                                          0x0040658a
                                                          0x0040658d
                                                          0x00406590
                                                          0x00406593
                                                          0x00406596
                                                          0x00406599
                                                          0x0040659c
                                                          0x0040659f
                                                          0x004065a5
                                                          0x004065bd
                                                          0x004065c0
                                                          0x004065c3
                                                          0x004065c6
                                                          0x004065c6
                                                          0x004065c9
                                                          0x004065cf
                                                          0x004065a7
                                                          0x004065a7
                                                          0x004065af
                                                          0x004065b4
                                                          0x004065b6
                                                          0x004065b8
                                                          0x004065b8
                                                          0x004065d9
                                                          0x004065dc
                                                          0x0040657f
                                                          0x00406585
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x004065de
                                                          0x0040655a
                                                          0x0040655e
                                                          0x00406b66
                                                          0x00000000
                                                          0x00406b66
                                                          0x00406564
                                                          0x00406567
                                                          0x0040656a
                                                          0x0040656e
                                                          0x00406571
                                                          0x00406577
                                                          0x00406579
                                                          0x00406579
                                                          0x0040657c
                                                          0x00000000
                                                          0x0040657c
                                                          0x00406396
                                                          0x00406396
                                                          0x00406399
                                                          0x0040639f
                                                          0x004063a1
                                                          0x004063a1
                                                          0x004063a4
                                                          0x004063a7
                                                          0x004063a9
                                                          0x004063aa
                                                          0x004063ad
                                                          0x0040641a
                                                          0x0040641a
                                                          0x0040641e
                                                          0x00406421
                                                          0x00406424
                                                          0x00406427
                                                          0x0040642a
                                                          0x0040642b
                                                          0x0040642e
                                                          0x00406430
                                                          0x00406436
                                                          0x00406439
                                                          0x0040643c
                                                          0x0040643f
                                                          0x00406442
                                                          0x00406448
                                                          0x00406464
                                                          0x00406467
                                                          0x0040646a
                                                          0x0040646d
                                                          0x00406474
                                                          0x0040647a
                                                          0x0040647e
                                                          0x0040644a
                                                          0x0040644a
                                                          0x0040644e
                                                          0x00406456
                                                          0x0040645b
                                                          0x0040645d
                                                          0x0040645f
                                                          0x0040645f
                                                          0x00406488
                                                          0x0040648b
                                                          0x00406402
                                                          0x00406402
                                                          0x00406408
                                                          0x004064bb
                                                          0x004064c1
                                                          0x00000000
                                                          0x00000000
                                                          0x004064c3
                                                          0x004064c6
                                                          0x004064c9
                                                          0x004064cc
                                                          0x004064cf
                                                          0x004064d2
                                                          0x004064d5
                                                          0x004064d8
                                                          0x004064db
                                                          0x004064e1
                                                          0x004064f9
                                                          0x004064fc
                                                          0x004064ff
                                                          0x00406502
                                                          0x00406502
                                                          0x00406505
                                                          0x0040650b
                                                          0x004064e3
                                                          0x004064e3
                                                          0x004064eb
                                                          0x004064f0
                                                          0x004064f2
                                                          0x004064f4
                                                          0x004064f4
                                                          0x00406515
                                                          0x00406518
                                                          0x00406496
                                                          0x0040649a
                                                          0x00406b5a
                                                          0x00000000
                                                          0x00406b5a
                                                          0x004064a0
                                                          0x004064a3
                                                          0x004064a6
                                                          0x004064aa
                                                          0x004064ad
                                                          0x004064b3
                                                          0x004064b5
                                                          0x004064b5
                                                          0x004064b8
                                                          0x004064b8
                                                          0x00406518
                                                          0x0040651f
                                                          0x0040651f
                                                          0x0040651f
                                                          0x00406523
                                                          0x00406523
                                                          0x00406526
                                                          0x00406529
                                                          0x0040652d
                                                          0x00406b72
                                                          0x00000000
                                                          0x00406b72
                                                          0x00406533
                                                          0x00406536
                                                          0x00406539
                                                          0x0040653c
                                                          0x0040653f
                                                          0x00406542
                                                          0x00406545
                                                          0x00406547
                                                          0x0040654a
                                                          0x0040654d
                                                          0x00406550
                                                          0x00406552
                                                          0x00406552
                                                          0x00406552
                                                          0x004066ef
                                                          0x004066ef
                                                          0x004066f2
                                                          0x004066f2
                                                          0x00000000
                                                          0x004066f2
                                                          0x00406414
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00406491
                                                          0x004063dd
                                                          0x004063e1
                                                          0x00406b4e
                                                          0x00406bca
                                                          0x00406bd2
                                                          0x00406bd9
                                                          0x00406bdb
                                                          0x00406be2
                                                          0x00406be6
                                                          0x00406be6
                                                          0x004063e7
                                                          0x004063ea
                                                          0x004063ed
                                                          0x004063f1
                                                          0x004063f4
                                                          0x004063fa
                                                          0x004063fc
                                                          0x004063fc
                                                          0x004063ff
                                                          0x00000000
                                                          0x004063ff
                                                          0x0040648b
                                                          0x00406394
                                                          0x004061c8
                                                          0x004061c8
                                                          0x004061d1
                                                          0x00406bdf
                                                          0x00406bdf
                                                          0x00000000
                                                          0x00406bdf
                                                          0x004061d7
                                                          0x00000000
                                                          0x004061e2
                                                          0x00000000
                                                          0x00000000
                                                          0x004061eb
                                                          0x004061ee
                                                          0x004061f1
                                                          0x004061f5
                                                          0x00000000
                                                          0x00000000
                                                          0x004061fb
                                                          0x004061fe
                                                          0x00406200
                                                          0x00406201
                                                          0x00406204
                                                          0x00406206
                                                          0x00406207
                                                          0x00406209
                                                          0x0040620c
                                                          0x00406211
                                                          0x00406216
                                                          0x0040621f
                                                          0x00406232
                                                          0x00406235
                                                          0x00406241
                                                          0x00406269
                                                          0x0040626b
                                                          0x00406279
                                                          0x00406279
                                                          0x0040627d
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040626d
                                                          0x0040626d
                                                          0x00406270
                                                          0x00406271
                                                          0x00406271
                                                          0x00000000
                                                          0x0040626d
                                                          0x00406247
                                                          0x0040624c
                                                          0x0040624c
                                                          0x00406255
                                                          0x0040625d
                                                          0x00406260
                                                          0x00000000
                                                          0x00406266
                                                          0x00406266
                                                          0x00000000
                                                          0x00406266
                                                          0x00000000
                                                          0x00406283
                                                          0x00406283
                                                          0x00406287
                                                          0x00406b33
                                                          0x00000000
                                                          0x00406b33
                                                          0x00406290
                                                          0x004062a0
                                                          0x004062a3
                                                          0x004062a6
                                                          0x004062a6
                                                          0x004062a6
                                                          0x004062a9
                                                          0x004062ad
                                                          0x00000000
                                                          0x00000000
                                                          0x004062af
                                                          0x004062b5
                                                          0x004062df
                                                          0x004062e5
                                                          0x004062ec
                                                          0x00000000
                                                          0x004062ec
                                                          0x004062bb
                                                          0x004062be
                                                          0x004062c3
                                                          0x004062c3
                                                          0x004062ce
                                                          0x004062d6
                                                          0x004062d9
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040631e
                                                          0x00406324
                                                          0x00406327
                                                          0x00406334
                                                          0x0040633c
                                                          0x00000000
                                                          0x00000000
                                                          0x004062f3
                                                          0x004062f3
                                                          0x004062f7
                                                          0x00406b42
                                                          0x00000000
                                                          0x00406b42
                                                          0x00406303
                                                          0x0040630e
                                                          0x0040630e
                                                          0x0040630e
                                                          0x00406311
                                                          0x00406314
                                                          0x00406317
                                                          0x0040631c
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x004065e3
                                                          0x004065e7
                                                          0x00406605
                                                          0x00406608
                                                          0x0040660f
                                                          0x00406612
                                                          0x00406615
                                                          0x00406618
                                                          0x0040661b
                                                          0x0040661e
                                                          0x00406620
                                                          0x00406627
                                                          0x00406628
                                                          0x0040662a
                                                          0x0040662d
                                                          0x00406630
                                                          0x00406633
                                                          0x00406633
                                                          0x00406638
                                                          0x00000000
                                                          0x00406638
                                                          0x004065e9
                                                          0x004065ec
                                                          0x004065ef
                                                          0x004065f9
                                                          0x00000000
                                                          0x00000000
                                                          0x0040664d
                                                          0x00406651
                                                          0x00406674
                                                          0x00406677
                                                          0x0040667a
                                                          0x00406684
                                                          0x00406653
                                                          0x00406653
                                                          0x00406656
                                                          0x00406659
                                                          0x0040665c
                                                          0x00406669
                                                          0x0040666c
                                                          0x0040666c
                                                          0x00000000
                                                          0x00000000
                                                          0x00406690
                                                          0x00406694
                                                          0x00000000
                                                          0x00000000
                                                          0x0040669a
                                                          0x0040669e
                                                          0x00000000
                                                          0x00000000
                                                          0x004066a4
                                                          0x004066a6
                                                          0x004066aa
                                                          0x004066aa
                                                          0x004066ad
                                                          0x004066b1
                                                          0x00000000
                                                          0x00000000
                                                          0x00406701
                                                          0x00406705
                                                          0x0040670c
                                                          0x0040670f
                                                          0x00406712
                                                          0x0040671c
                                                          0x00000000
                                                          0x0040671c
                                                          0x00406707
                                                          0x00000000
                                                          0x00000000
                                                          0x00406728
                                                          0x0040672c
                                                          0x00406733
                                                          0x00406736
                                                          0x00406739
                                                          0x0040672e
                                                          0x0040672e
                                                          0x0040672e
                                                          0x0040673c
                                                          0x0040673f
                                                          0x00406742
                                                          0x00406742
                                                          0x00406745
                                                          0x00406748
                                                          0x0040674b
                                                          0x0040674b
                                                          0x0040674e
                                                          0x00406755
                                                          0x0040675a
                                                          0x00000000
                                                          0x00000000
                                                          0x004067e8
                                                          0x004067e8
                                                          0x004067ec
                                                          0x00406b8a
                                                          0x00000000
                                                          0x00406b8a
                                                          0x004067f2
                                                          0x004067f5
                                                          0x004067f8
                                                          0x004067fc
                                                          0x004067ff
                                                          0x00406805
                                                          0x00406807
                                                          0x00406807
                                                          0x00406807
                                                          0x0040680a
                                                          0x0040680d
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040686b
                                                          0x0040686b
                                                          0x0040686f
                                                          0x00406b96
                                                          0x00000000
                                                          0x00406b96
                                                          0x00406875
                                                          0x00406878
                                                          0x0040687b
                                                          0x0040687f
                                                          0x00406882
                                                          0x00406888
                                                          0x0040688a
                                                          0x0040688a
                                                          0x0040688a
                                                          0x0040688d
                                                          0x00000000
                                                          0x00000000
                                                          0x0040663b
                                                          0x0040663b
                                                          0x0040663e
                                                          0x00000000
                                                          0x00000000
                                                          0x0040697a
                                                          0x0040697e
                                                          0x004069a0
                                                          0x004069a3
                                                          0x004069ad
                                                          0x00000000
                                                          0x004069ad
                                                          0x00406980
                                                          0x00406983
                                                          0x00406987
                                                          0x0040698a
                                                          0x0040698a
                                                          0x0040698d
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a37
                                                          0x00406a3b
                                                          0x00406a59
                                                          0x00406a59
                                                          0x00406a59
                                                          0x00406a60
                                                          0x00406a67
                                                          0x00406a6e
                                                          0x00406a6e
                                                          0x00000000
                                                          0x00406a6e
                                                          0x00406a3d
                                                          0x00406a40
                                                          0x00406a43
                                                          0x00406a46
                                                          0x00406a4d
                                                          0x00406991
                                                          0x00406991
                                                          0x00406994
                                                          0x00000000
                                                          0x00000000
                                                          0x00406b28
                                                          0x00406b2b
                                                          0x00000000
                                                          0x00000000
                                                          0x00406762
                                                          0x00406764
                                                          0x0040676b
                                                          0x0040676c
                                                          0x0040676e
                                                          0x00406771
                                                          0x00000000
                                                          0x00000000
                                                          0x00406779
                                                          0x0040677c
                                                          0x0040677f
                                                          0x00406781
                                                          0x00406783
                                                          0x00406783
                                                          0x00406784
                                                          0x00406787
                                                          0x0040678e
                                                          0x00406791
                                                          0x0040679f
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a75
                                                          0x00406a75
                                                          0x00406a78
                                                          0x00406a7f
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a84
                                                          0x00406a84
                                                          0x00406a88
                                                          0x00406bc0
                                                          0x00000000
                                                          0x00406bc0
                                                          0x00406a8e
                                                          0x00406a91
                                                          0x00406a94
                                                          0x00406a98
                                                          0x00406a9b
                                                          0x00406aa1
                                                          0x00406aa3
                                                          0x00406aa3
                                                          0x00406aa3
                                                          0x00406aa6
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aac
                                                          0x00406aac
                                                          0x00406ab0
                                                          0x00406b10
                                                          0x00406b13
                                                          0x00406b18
                                                          0x00406b19
                                                          0x00406b1b
                                                          0x00406b1d
                                                          0x00406b20
                                                          0x00000000
                                                          0x00406b20
                                                          0x00406ab2
                                                          0x00406ab8
                                                          0x00406abb
                                                          0x00406abe
                                                          0x00406ac1
                                                          0x00406ac4
                                                          0x00406ac7
                                                          0x00406aca
                                                          0x00406acd
                                                          0x00406ad0
                                                          0x00406ad3
                                                          0x00406aec
                                                          0x00406aef
                                                          0x00406af2
                                                          0x00406af5
                                                          0x00406af9
                                                          0x00406afb
                                                          0x00406afb
                                                          0x00406afc
                                                          0x00406aff
                                                          0x00406ad5
                                                          0x00406ad5
                                                          0x00406add
                                                          0x00406ae2
                                                          0x00406ae4
                                                          0x00406ae7
                                                          0x00406ae7
                                                          0x00406b02
                                                          0x00406b09
                                                          0x00000000
                                                          0x00406b0b
                                                          0x00000000
                                                          0x00406b0b
                                                          0x00000000
                                                          0x004067a7
                                                          0x004067aa
                                                          0x004067e0
                                                          0x00406910
                                                          0x00406910
                                                          0x00406910
                                                          0x00406910
                                                          0x00406913
                                                          0x00406913
                                                          0x00406916
                                                          0x00406918
                                                          0x00406ba2
                                                          0x00000000
                                                          0x00406ba2
                                                          0x0040691e
                                                          0x00406921
                                                          0x00000000
                                                          0x00000000
                                                          0x00406927
                                                          0x0040692b
                                                          0x0040692e
                                                          0x0040692e
                                                          0x0040692e
                                                          0x00000000
                                                          0x0040692e
                                                          0x004067ac
                                                          0x004067ae
                                                          0x004067b0
                                                          0x004067b2
                                                          0x004067b5
                                                          0x004067b6
                                                          0x004067b8
                                                          0x004067ba
                                                          0x004067bd
                                                          0x004067c0
                                                          0x004067d6
                                                          0x004067db
                                                          0x00406813
                                                          0x00406813
                                                          0x00406817
                                                          0x00406843
                                                          0x00406845
                                                          0x0040684c
                                                          0x0040684f
                                                          0x00406852
                                                          0x00406852
                                                          0x00406857
                                                          0x00406857
                                                          0x00406859
                                                          0x0040685c
                                                          0x00406863
                                                          0x00406866
                                                          0x00406893
                                                          0x00406893
                                                          0x00406896
                                                          0x00406899
                                                          0x0040690d
                                                          0x0040690d
                                                          0x0040690d
                                                          0x00000000
                                                          0x0040690d
                                                          0x0040689b
                                                          0x004068a1
                                                          0x004068a4
                                                          0x004068a7
                                                          0x004068aa
                                                          0x004068ad
                                                          0x004068b0
                                                          0x004068b3
                                                          0x004068b6
                                                          0x004068b9
                                                          0x004068bc
                                                          0x004068d5
                                                          0x004068d7
                                                          0x004068da
                                                          0x004068db
                                                          0x004068de
                                                          0x004068e0
                                                          0x004068e3
                                                          0x004068e5
                                                          0x004068e7
                                                          0x004068ea
                                                          0x004068ec
                                                          0x004068ef
                                                          0x004068f3
                                                          0x004068f5
                                                          0x004068f5
                                                          0x004068f6
                                                          0x004068f9
                                                          0x004068fc
                                                          0x004068be
                                                          0x004068be
                                                          0x004068c6
                                                          0x004068cb
                                                          0x004068cd
                                                          0x004068d0
                                                          0x004068d0
                                                          0x004068ff
                                                          0x00406906
                                                          0x00406890
                                                          0x00406890
                                                          0x00406890
                                                          0x00406890
                                                          0x00000000
                                                          0x00406908
                                                          0x00000000
                                                          0x00406908
                                                          0x00406906
                                                          0x00406819
                                                          0x0040681c
                                                          0x0040681e
                                                          0x00406821
                                                          0x00406824
                                                          0x00406827
                                                          0x00406829
                                                          0x0040682c
                                                          0x0040682f
                                                          0x0040682f
                                                          0x00406832
                                                          0x00406832
                                                          0x00406835
                                                          0x0040683c
                                                          0x00406810
                                                          0x00406810
                                                          0x00406810
                                                          0x00406810
                                                          0x00000000
                                                          0x0040683e
                                                          0x00000000
                                                          0x0040683e
                                                          0x0040683c
                                                          0x004067c2
                                                          0x004067c5
                                                          0x004067c7
                                                          0x004067ca
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x004066b4
                                                          0x004066b4
                                                          0x004066b8
                                                          0x00406b7e
                                                          0x00000000
                                                          0x00406b7e
                                                          0x004066be
                                                          0x004066c1
                                                          0x004066c4
                                                          0x004066c7
                                                          0x004066c9
                                                          0x004066c9
                                                          0x004066c9
                                                          0x004066cc
                                                          0x004066cf
                                                          0x004066d2
                                                          0x004066d5
                                                          0x004066d8
                                                          0x004066db
                                                          0x004066dc
                                                          0x004066de
                                                          0x004066de
                                                          0x004066de
                                                          0x004066e1
                                                          0x004066e4
                                                          0x004066e7
                                                          0x004066ea
                                                          0x004066ea
                                                          0x004066ea
                                                          0x004066ed
                                                          0x00000000
                                                          0x00000000
                                                          0x00406931
                                                          0x00406931
                                                          0x00406931
                                                          0x00406935
                                                          0x00000000
                                                          0x00000000
                                                          0x0040693b
                                                          0x0040693e
                                                          0x00406941
                                                          0x00406944
                                                          0x00406946
                                                          0x00406946
                                                          0x00406946
                                                          0x00406949
                                                          0x0040694c
                                                          0x0040694f
                                                          0x00406952
                                                          0x00406955
                                                          0x00406958
                                                          0x00406959
                                                          0x0040695b
                                                          0x0040695b
                                                          0x0040695b
                                                          0x0040695e
                                                          0x00406961
                                                          0x00406964
                                                          0x00406967
                                                          0x0040696a
                                                          0x0040696e
                                                          0x00406970
                                                          0x00406973
                                                          0x00000000
                                                          0x00406975
                                                          0x00000000
                                                          0x00406975
                                                          0x00406973
                                                          0x00406ba8
                                                          0x00000000
                                                          0x00000000
                                                          0x004061d7

                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e28a8ad83f22bfe4c4d455a141f03dc38bf257c2203b46f6b1d5cba347f55b6d
                                                          • Instruction ID: a8746b25a1c6b49bbeafbf020c2dfcaa04563a9eac1a8e827fb2969916571183
                                                          • Opcode Fuzzy Hash: e28a8ad83f22bfe4c4d455a141f03dc38bf257c2203b46f6b1d5cba347f55b6d
                                                          • Instruction Fuzzy Hash: 70F17670D00229CBCF18CFA8C8946ADBBB1FF44305F25816ED856BB281D7786A96CF44
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00405FFD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00405FFD(CHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileA(_a4, 0x421558); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2); // executed
				return 0x421558;
			}




                                                          0x00406008
                                                          0x00406011
                                                          0x00000000
                                                          0x0040601e
                                                          0x00406014
                                                          0x00000000

                                                          APIs
                                                          • FindFirstFileA.KERNELBASE(74D0FA90,00421558,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,0040589C,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,74D0FA90,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,74D0FA90,C:\Users\user\AppData\Local\Temp\), ref: 00406008
                                                          • FindClose.KERNELBASE(00000000), ref: 00406014
                                                          Strings
                                                          • C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp, xrefs: 00405FFD
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Find$CloseFileFirst
                                                          • String ID: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp
                                                          • API String ID: 2295610775-3143865396
                                                          • Opcode ID: fb61142ecab510d9bb051178c92cda44e9a3fae507c1338c77e1024ce068b834
                                                          • Instruction ID: 1297c1e42099762feae64532f60583430090df1d404adb2e37743a0561846f6f
                                                          • Opcode Fuzzy Hash: fb61142ecab510d9bb051178c92cda44e9a3fae507c1338c77e1024ce068b834
                                                          • Instruction Fuzzy Hash: 8CD012319491206BC3105B38AD0C85B7A599F593317118A33F567F52F0C7788C7296E9
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00403A0B Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 345windowstringCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 179 403a0b-403a1d 180 403a23-403a29 179->180 181 403b5e-403b6d 179->181 180->181 182 403a2f-403a38 180->182 183 403bbc-403bd1 181->183 184 403b6f-403baa GetDlgItem * 2 call 403ede KiUserCallbackDispatcher call 40140b 181->184 185 403a3a-403a47 SetWindowPos 182->185 186 403a4d-403a50 182->186 188 403c11-403c16 call 403f2a 183->188 189 403bd3-403bd6 183->189 207 403baf-403bb7 184->207 185->186 191 403a52-403a64 ShowWindow 186->191 192 403a6a-403a70 186->192 198 403c1b-403c36 188->198 194 403bd8-403be3 call 401389 189->194 195 403c09-403c0b 189->195 191->192 199 403a72-403a87 DestroyWindow 192->199 200 403a8c-403a8f 192->200 194->195 210 403be5-403c04 SendMessageA 194->210 195->188 197 403eab 195->197 205 403ead-403eb4 197->205 203 403c38-403c3a call 40140b 198->203 204 403c3f-403c45 198->204 206 403e88-403e8e 199->206 208 403a91-403a9d SetWindowLongA 200->208 209 403aa2-403aa8 200->209 203->204 213 403e69-403e82 DestroyWindow EndDialog 204->213 214 403c4b-403c56 204->214 206->197 211 403e90-403e96 206->211 207->183 208->205 215 403b4b-403b59 call 403f45 209->215 216 403aae-403abf GetDlgItem 209->216 210->205 211->197 220 403e98-403ea1 ShowWindow 211->220 213->206 214->213 221 403c5c-403ca9 call 405d1b call 403ede * 3 GetDlgItem 214->221 215->205 217 403ac1-403ad8 SendMessageA IsWindowEnabled 216->217 218 403ade-403ae1 216->218 217->197 217->218 222 403ae3-403ae4 218->222 223 403ae6-403ae9 218->223 220->197 249 403cb3-403cef ShowWindow KiUserCallbackDispatcher call 403f00 EnableWindow 221->249 250 403cab-403cb0 221->250 226 403b14-403b19 call 403eb7 222->226 227 403af7-403afc 223->227 228 403aeb-403af1 223->228 226->215 230 403b32-403b45 SendMessageA 227->230 232 403afe-403b04 227->232 228->230 231 403af3-403af5 228->231 230->215 231->226 235 403b06-403b0c call 40140b 232->235 236 403b1b-403b24 call 40140b 232->236 247 403b12 235->247 236->215 245 403b26-403b30 236->245 245->247 247->226 253 403cf1-403cf2 249->253 254 403cf4 249->254 250->249 255 403cf6-403d24 GetSystemMenu EnableMenuItem SendMessageA 253->255 254->255 256 403d26-403d37 SendMessageA 255->256 257 403d39 255->257 258 403d3f-403d78 call 403f13 call 405cf9 lstrlenA call 405d1b SetWindowTextA call 401389 256->258 257->258 258->198 267 403d7e-403d80 258->267 267->198 268 403d86-403d8a 267->268 269 403da9-403dbd DestroyWindow 268->269 270 403d8c-403d92 268->270 269->206 272 403dc3-403df0 CreateDialogParamA 269->272 270->197 271 403d98-403d9e 270->271 271->198 273 403da4 271->273 272->206 274 403df6-403e4d call 403ede GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 401389 272->274 273->197 274->197 279 403e4f-403e62 ShowWindow call 403f2a 274->279 281 403e67 279->281 281->206
                                                          C-Code - Quality: 84%
                                                          			E00403A0B(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				signed int _t39;
				struct HWND__* _t49;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t115;
				signed int _t116;
				int _t117;
				signed int _t122;
				struct HWND__* _t125;
				struct HWND__* _t126;
				int _t127;
				long _t130;
				int _t132;
				int _t133;
				void* _t134;
				void* _t142;

				_t115 = _a8;
				if(_t115 == 0x110 || _t115 == 0x408) {
					_t35 = _a12;
					_t125 = _a4;
					__eflags = _t115 - 0x110;
					 *0x41fcf0 = _t35;
					if(_t115 == 0x110) {
						 *0x423708 = _t125;
						 *0x41fd04 = GetDlgItem(_t125, 1);
						_t91 = GetDlgItem(_t125, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x41ecd0 = _t91;
						E00403EDE(_t125);
						SetClassLongA(_t125, 0xfffffff2,  *0x422ee8); // executed
						 *0x422ecc = E0040140B(4);
						_t35 = 1;
						__eflags = 1;
						 *0x41fcf0 = 1;
					}
					_t122 =  *0x4091dc; // 0x0
					_t133 = 0;
					_t130 = (_t122 << 6) +  *0x423720;
					__eflags = _t122;
					if(_t122 < 0) {
						L34:
						E00403F2A(0x40b);
						while(1) {
							_t37 =  *0x41fcf0; // 0x1
							 *0x4091dc =  *0x4091dc + _t37;
							_t130 = _t130 + (_t37 << 6);
							_t39 =  *0x4091dc; // 0x0
							__eflags = _t39 -  *0x423724;
							if(_t39 ==  *0x423724) {
								E0040140B(1);
							}
							__eflags =  *0x422ecc - _t133; // 0x0
							if(__eflags != 0) {
								break;
							}
							__eflags =  *0x4091dc -  *0x423724; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t116 =  *(_t130 + 0x14);
							E00405D1B(_t116, _t125, _t130, "Click Next to continue.",  *((intOrPtr*)(_t130 + 0x24)));
							_push( *((intOrPtr*)(_t130 + 0x20)));
							_push(0xfffffc19);
							E00403EDE(_t125);
							_push( *((intOrPtr*)(_t130 + 0x1c)));
							_push(0xfffffc1b);
							E00403EDE(_t125);
							_push( *((intOrPtr*)(_t130 + 0x28)));
							_push(0xfffffc1a);
							E00403EDE(_t125);
							_t49 = GetDlgItem(_t125, 3);
							__eflags =  *0x42378c - _t133;
							_v32 = _t49;
							if( *0x42378c != _t133) {
								_t116 = _t116 & 0x0000fefd | 0x00000004;
								__eflags = _t116;
							}
							ShowWindow(_t49, _t116 & 0x00000008); // executed
							EnableWindow( *(_t134 + 0x30), _t116 & 0x00000100); // executed
							E00403F00(_t116 & 0x00000002);
							_t117 = _t116 & 0x00000004;
							EnableWindow( *0x41ecd0, _t117);
							__eflags = _t117 - _t133;
							if(_t117 == _t133) {
								_push(1);
							} else {
								_push(_t133);
							}
							EnableMenuItem(GetSystemMenu(_t125, _t133), 0xf060, ??);
							SendMessageA( *(_t134 + 0x38), 0xf4, _t133, 1);
							__eflags =  *0x42378c - _t133;
							if( *0x42378c == _t133) {
								_push( *0x41fd04);
							} else {
								SendMessageA(_t125, 0x401, 2, _t133);
								_push( *0x41ecd0);
							}
							E00403F13();
							E00405CF9(0x41fd08, 0x422f00);
							E00405D1B(0x41fd08, _t125, _t130,  &(0x41fd08[lstrlenA(0x41fd08)]),  *((intOrPtr*)(_t130 + 0x18)));
							SetWindowTextA(_t125, 0x41fd08); // executed
							_push(_t133);
							_t67 = E00401389( *((intOrPtr*)(_t130 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t130 - _t133;
								if( *_t130 == _t133) {
									continue;
								}
								__eflags =  *(_t130 + 4) - 5;
								if( *(_t130 + 4) != 5) {
									DestroyWindow( *0x422ed8); // executed
									 *0x41f4e0 = _t130;
									__eflags =  *_t130 - _t133;
									if( *_t130 <= _t133) {
										goto L58;
									}
									_t73 = CreateDialogParamA( *0x423700,  *_t130 +  *0x422ee0 & 0x0000ffff, _t125,  *( *(_t130 + 4) * 4 + "\'@@"), _t130); // executed
									__eflags = _t73 - _t133;
									 *0x422ed8 = _t73;
									if(_t73 == _t133) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t130 + 0x2c)));
									_push(6);
									E00403EDE(_t73);
									GetWindowRect(GetDlgItem(_t125, 0x3fa), _t134 + 0x10);
									ScreenToClient(_t125, _t134 + 0x10);
									SetWindowPos( *0x422ed8, _t133,  *(_t134 + 0x20),  *(_t134 + 0x20), _t133, _t133, 0x15);
									_push(_t133);
									E00401389( *((intOrPtr*)(_t130 + 0xc)));
									__eflags =  *0x422ecc - _t133; // 0x0
									if(__eflags != 0) {
										goto L61;
									}
									ShowWindow( *0x422ed8, 8); // executed
									E00403F2A(0x405);
									goto L58;
								}
								__eflags =  *0x42378c - _t133;
								if( *0x42378c != _t133) {
									goto L61;
								}
								__eflags =  *0x423780 - _t133;
								if( *0x423780 != _t133) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x422ed8);
						 *0x423708 = _t133;
						EndDialog(_t125,  *0x41f0d8);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t130 - _t133;
							if( *_t130 == _t133) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t130 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L33;
						}
						SendMessageA( *0x422ed8, 0x40f, 0, 1);
						__eflags =  *0x422ecc - _t133; // 0x0
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t125 = _a4;
					_t133 = 0;
					if(_t115 == 0x47) {
						SetWindowPos( *0x41fce8, _t125, 0, 0, 0, 0, 0x13);
					}
					if(_t115 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x41fce8,  ~(_a12 - 1) & _t115);
					}
					if(_t115 != 0x40d) {
						__eflags = _t115 - 0x11;
						if(_t115 != 0x11) {
							__eflags = _t115 - 0x111;
							if(_t115 != 0x111) {
								L26:
								return E00403F45(_t115, _a12, _a16);
							}
							_t132 = _a12 & 0x0000ffff;
							_t126 = GetDlgItem(_t125, _t132);
							__eflags = _t126 - _t133;
							if(_t126 == _t133) {
								L13:
								__eflags = _t132 - 1;
								if(_t132 != 1) {
									__eflags = _t132 - 3;
									if(_t132 != 3) {
										_t127 = 2;
										__eflags = _t132 - _t127;
										if(_t132 != _t127) {
											L25:
											SendMessageA( *0x422ed8, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x42378c - _t133;
										if( *0x42378c == _t133) {
											_t99 = E0040140B(3);
											__eflags = _t99;
											if(_t99 != 0) {
												goto L26;
											}
											 *0x41f0d8 = 1;
											L21:
											_push(0x78);
											L22:
											E00403EB7();
											goto L26;
										}
										E0040140B(_t127);
										 *0x41f0d8 = _t127;
										goto L21;
									}
									__eflags =  *0x4091dc - _t133; // 0x0
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t132);
								goto L22;
							}
							SendMessageA(_t126, 0xf3, _t133, _t133);
							_t103 = IsWindowEnabled(_t126);
							__eflags = _t103;
							if(_t103 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t125, _t133, _t133);
						return 1;
					} else {
						DestroyWindow( *0x422ed8);
						 *0x422ed8 = _a12;
						L58:
						if( *0x420d08 == _t133) {
							_t142 =  *0x422ed8 - _t133; // 0x1042e
							if(_t142 != 0) {
								ShowWindow(_t125, 0xa); // executed
								 *0x420d08 = 1;
							}
						}
						L61:
						return 0;
					}
				}
			}































                                                          0x00403a14
                                                          0x00403a1d
                                                          0x00403b5e
                                                          0x00403b62
                                                          0x00403b66
                                                          0x00403b68
                                                          0x00403b6d
                                                          0x00403b78
                                                          0x00403b83
                                                          0x00403b88
                                                          0x00403b8a
                                                          0x00403b8c
                                                          0x00403b8f
                                                          0x00403b94
                                                          0x00403ba2
                                                          0x00403baf
                                                          0x00403bb6
                                                          0x00403bb6
                                                          0x00403bb7
                                                          0x00403bb7
                                                          0x00403bbc
                                                          0x00403bc2
                                                          0x00403bc9
                                                          0x00403bcf
                                                          0x00403bd1
                                                          0x00403c11
                                                          0x00403c16
                                                          0x00403c1b
                                                          0x00403c1b
                                                          0x00403c20
                                                          0x00403c29
                                                          0x00403c2b
                                                          0x00403c30
                                                          0x00403c36
                                                          0x00403c3a
                                                          0x00403c3a
                                                          0x00403c3f
                                                          0x00403c45
                                                          0x00000000
                                                          0x00000000
                                                          0x00403c50
                                                          0x00403c56
                                                          0x00000000
                                                          0x00000000
                                                          0x00403c5f
                                                          0x00403c67
                                                          0x00403c6c
                                                          0x00403c6f
                                                          0x00403c75
                                                          0x00403c7a
                                                          0x00403c7d
                                                          0x00403c83
                                                          0x00403c88
                                                          0x00403c8b
                                                          0x00403c91
                                                          0x00403c99
                                                          0x00403c9f
                                                          0x00403ca5
                                                          0x00403ca9
                                                          0x00403cb0
                                                          0x00403cb0
                                                          0x00403cb0
                                                          0x00403cba
                                                          0x00403ccc
                                                          0x00403cd8
                                                          0x00403cdd
                                                          0x00403ce7
                                                          0x00403ced
                                                          0x00403cef
                                                          0x00403cf4
                                                          0x00403cf1
                                                          0x00403cf1
                                                          0x00403cf1
                                                          0x00403d04
                                                          0x00403d1c
                                                          0x00403d1e
                                                          0x00403d24
                                                          0x00403d39
                                                          0x00403d26
                                                          0x00403d2f
                                                          0x00403d31
                                                          0x00403d31
                                                          0x00403d3f
                                                          0x00403d4f
                                                          0x00403d60
                                                          0x00403d67
                                                          0x00403d6d
                                                          0x00403d71
                                                          0x00403d76
                                                          0x00403d78
                                                          0x00000000
                                                          0x00403d7e
                                                          0x00403d7e
                                                          0x00403d80
                                                          0x00000000
                                                          0x00000000
                                                          0x00403d86
                                                          0x00403d8a
                                                          0x00403daf
                                                          0x00403db5
                                                          0x00403dbb
                                                          0x00403dbd
                                                          0x00000000
                                                          0x00000000
                                                          0x00403de3
                                                          0x00403de9
                                                          0x00403deb
                                                          0x00403df0
                                                          0x00000000
                                                          0x00000000
                                                          0x00403df6
                                                          0x00403df9
                                                          0x00403dfc
                                                          0x00403e13
                                                          0x00403e1f
                                                          0x00403e38
                                                          0x00403e3e
                                                          0x00403e42
                                                          0x00403e47
                                                          0x00403e4d
                                                          0x00000000
                                                          0x00000000
                                                          0x00403e57
                                                          0x00403e62
                                                          0x00000000
                                                          0x00403e62
                                                          0x00403d8c
                                                          0x00403d92
                                                          0x00000000
                                                          0x00000000
                                                          0x00403d98
                                                          0x00403d9e
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00403da4
                                                          0x00403d78
                                                          0x00403e6f
                                                          0x00403e7b
                                                          0x00403e82
                                                          0x00000000
                                                          0x00403bd3
                                                          0x00403bd3
                                                          0x00403bd6
                                                          0x00403c09
                                                          0x00403c09
                                                          0x00403c0b
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00403c0b
                                                          0x00403bd8
                                                          0x00403bdc
                                                          0x00403be1
                                                          0x00403be3
                                                          0x00000000
                                                          0x00000000
                                                          0x00403bf3
                                                          0x00403bfb
                                                          0x00000000
                                                          0x00403c01
                                                          0x00403a2f
                                                          0x00403a2f
                                                          0x00403a33
                                                          0x00403a38
                                                          0x00403a47
                                                          0x00403a47
                                                          0x00403a50
                                                          0x00403a59
                                                          0x00403a64
                                                          0x00403a64
                                                          0x00403a70
                                                          0x00403a8c
                                                          0x00403a8f
                                                          0x00403aa2
                                                          0x00403aa8
                                                          0x00403b4b
                                                          0x00000000
                                                          0x00403b54
                                                          0x00403aae
                                                          0x00403abb
                                                          0x00403abd
                                                          0x00403abf
                                                          0x00403ade
                                                          0x00403ade
                                                          0x00403ae1
                                                          0x00403ae6
                                                          0x00403ae9
                                                          0x00403af9
                                                          0x00403afa
                                                          0x00403afc
                                                          0x00403b32
                                                          0x00403b45
                                                          0x00000000
                                                          0x00403b45
                                                          0x00403afe
                                                          0x00403b04
                                                          0x00403b1d
                                                          0x00403b22
                                                          0x00403b24
                                                          0x00000000
                                                          0x00000000
                                                          0x00403b26
                                                          0x00403b12
                                                          0x00403b12
                                                          0x00403b14
                                                          0x00403b14
                                                          0x00000000
                                                          0x00403b14
                                                          0x00403b07
                                                          0x00403b0c
                                                          0x00000000
                                                          0x00403b0c
                                                          0x00403aeb
                                                          0x00403af1
                                                          0x00000000
                                                          0x00000000
                                                          0x00403af3
                                                          0x00000000
                                                          0x00403af3
                                                          0x00403ae3
                                                          0x00000000
                                                          0x00403ae3
                                                          0x00403ac9
                                                          0x00403ad0
                                                          0x00403ad6
                                                          0x00403ad8
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00403ad8
                                                          0x00403a94
                                                          0x00000000
                                                          0x00403a72
                                                          0x00403a78
                                                          0x00403a82
                                                          0x00403e88
                                                          0x00403e8e
                                                          0x00403e90
                                                          0x00403e96
                                                          0x00403e9b
                                                          0x00403ea1
                                                          0x00403ea1
                                                          0x00403e96
                                                          0x00403eab
                                                          0x00000000
                                                          0x00403eab
                                                          0x00403a70

                                                          APIs
                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403A47
                                                          • ShowWindow.USER32(?), ref: 00403A64
                                                          • DestroyWindow.USER32 ref: 00403A78
                                                          • SetWindowLongA.USER32 ref: 00403A94
                                                          • GetDlgItem.USER32 ref: 00403AB5
                                                          • SendMessageA.USER32 ref: 00403AC9
                                                          • IsWindowEnabled.USER32(00000000), ref: 00403AD0
                                                          • GetDlgItem.USER32 ref: 00403B7E
                                                          • GetDlgItem.USER32 ref: 00403B88
                                                          • KiUserCallbackDispatcher.NTDLL(?,000000F2,?,0000001C,000000FF), ref: 00403BA2
                                                          • SendMessageA.USER32 ref: 00403BF3
                                                          • GetDlgItem.USER32 ref: 00403C99
                                                          • ShowWindow.USER32(00000000,?), ref: 00403CBA
                                                          • KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403CCC
                                                          • EnableWindow.USER32(?,?), ref: 00403CE7
                                                          • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403CFD
                                                          • EnableMenuItem.USER32 ref: 00403D04
                                                          • SendMessageA.USER32 ref: 00403D1C
                                                          • SendMessageA.USER32 ref: 00403D2F
                                                          • lstrlenA.KERNEL32(Staalbrylluppets Setup: Installing,?,Staalbrylluppets Setup: Installing,00422F00), ref: 00403D58
                                                          • SetWindowTextA.USER32(?,Staalbrylluppets Setup: Installing), ref: 00403D67
                                                          • ShowWindow.USER32(?,0000000A), ref: 00403E9B
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Window$Item$MessageSend$Show$CallbackDispatcherEnableMenuUser$DestroyEnabledLongSystemTextlstrlen
                                                          • String ID: Click Next to continue.$Staalbrylluppets Setup: Installing
                                                          • API String ID: 3906175533-2249967372
                                                          • Opcode ID: a09fd53bcea1d5388331638dafbcd4a7116fbc6ebc325bbc9a35e983d0eec3aa
                                                          • Instruction ID: e8e4c14712e0ebd1bd3c96694815290efe84e81baa174b168cbdfcdac135d6c4
                                                          • Opcode Fuzzy Hash: a09fd53bcea1d5388331638dafbcd4a7116fbc6ebc325bbc9a35e983d0eec3aa
                                                          • Instruction Fuzzy Hash: 29C1DF71A04205BBDB20AF61EE45E2B3E7CFB45706B40453EF601B11E1C779A942AB6E
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00403679 Relevance: 49.2, APIs: 14, Strings: 14, Instructions: 215stringregistryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 282 403679-403691 call 406092 285 403693-40369e GetUserDefaultUILanguage call 405c57 282->285 286 4036a5-4036d6 call 405be0 282->286 289 4036a3 285->289 292 4036d8-4036e9 call 405be0 286->292 293 4036ee-4036f4 lstrcatA 286->293 291 4036f9-403722 call 40393e call 405859 289->291 299 403728-40372d 291->299 300 4037a9-4037b1 call 405859 291->300 292->293 293->291 299->300 301 40372f-403753 call 405be0 299->301 306 4037b3-4037ba call 405d1b 300->306 307 4037bf-4037e4 LoadImageA 300->307 301->300 308 403755-403757 301->308 306->307 310 403865-40386d call 40140b 307->310 311 4037e6-403816 RegisterClassA 307->311 312 403768-403774 lstrlenA 308->312 313 403759-403766 call 405796 308->313 325 403877-403882 call 40393e 310->325 326 40386f-403872 310->326 314 403934 311->314 315 40381c-403860 SystemParametersInfoA CreateWindowExA 311->315 319 403776-403784 lstrcmpiA 312->319 320 40379c-4037a4 call 40576b call 405cf9 312->320 313->312 318 403936-40393d 314->318 315->310 319->320 324 403786-403790 GetFileAttributesA 319->324 320->300 329 403792-403794 324->329 330 403796-403797 call 4057b2 324->330 334 403888-4038a2 ShowWindow call 406024 325->334 335 40390b-40390c call 404fe4 325->335 326->318 329->320 329->330 330->320 342 4038a4-4038a9 call 406024 334->342 343 4038ae-4038c0 GetClassInfoA 334->343 338 403911-403913 335->338 340 403915-40391b 338->340 341 40392d-40392f call 40140b 338->341 340->326 344 403921-403928 call 40140b 340->344 341->314 342->343 347 4038c2-4038d2 GetClassInfoA RegisterClassA 343->347 348 4038d8-4038fb DialogBoxParamA call 40140b 343->348 344->326 347->348 352 403900-403909 call 4035c9 348->352 352->318
                                                          C-Code - Quality: 96%
                                                          			E00403679(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t17;
				void* _t25;
				void* _t27;
				int _t28;
				void* _t31;
				int _t34;
				int _t35;
				intOrPtr _t36;
				int _t39;
				char _t57;
				CHAR* _t59;
				signed char _t63;
				signed short _t67;
				CHAR* _t74;
				intOrPtr _t76;
				CHAR* _t81;

				_t76 =  *0x423710;
				_t17 = E00406092(2);
				_t84 = _t17;
				if(_t17 == 0) {
					_t74 = 0x41fd08;
					"1033" = 0x30;
					 *0x42a001 = 0x78;
					 *0x42a002 = 0;
					E00405BE0(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x41fd08, 0);
					__eflags =  *0x41fd08; // 0x53
					if(__eflags == 0) {
						E00405BE0(0x80000003, ".DEFAULT\\Control Panel\\International",  &M0040735A, 0x41fd08, 0);
					}
					lstrcatA("1033", _t74);
				} else {
					_t67 =  *_t17(); // executed
					E00405C57("1033", _t67 & 0x0000ffff);
				}
				E0040393E(_t71, _t84);
				_t80 = "C:\\Users\\hardz\\Pacifisterne\\Automatcafeer";
				 *0x423780 =  *0x423718 & 0x00000020;
				 *0x42379c = 0x10000;
				if(E00405859(_t84, "C:\\Users\\hardz\\Pacifisterne\\Automatcafeer") != 0) {
					L16:
					if(E00405859(_t92, _t80) == 0) {
						E00405D1B(0, _t74, _t76, _t80,  *((intOrPtr*)(_t76 + 0x118))); // executed
					}
					_t25 = LoadImageA( *0x423700, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x422ee8 = _t25;
					if( *((intOrPtr*)(_t76 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t27 = E0040393E(_t71, __eflags);
							__eflags =  *0x4237a0;
							if( *0x4237a0 != 0) {
								_t28 = E00404FE4(_t27, 0);
								__eflags = _t28;
								if(_t28 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x422ecc; // 0x0
								if(__eflags == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x41fce8, 5); // executed
							_t34 = E00406024("RichEd20"); // executed
							__eflags = _t34;
							if(_t34 == 0) {
								E00406024("RichEd32");
							}
							_t81 = "RichEdit20A";
							_t35 = GetClassInfoA(0, _t81, 0x422ea0);
							__eflags = _t35;
							if(_t35 == 0) {
								GetClassInfoA(0, "RichEdit", 0x422ea0);
								 *0x422ec4 = _t81;
								RegisterClassA(0x422ea0);
							}
							_t36 =  *0x422ee0; // 0x0
							_t39 = DialogBoxParamA( *0x423700, _t36 + 0x00000069 & 0x0000ffff, 0, E00403A0B, 0); // executed
							E004035C9(E0040140B(5), 1);
							return _t39;
						}
						L22:
						_t31 = 2;
						return _t31;
					} else {
						_t71 =  *0x423700;
						 *0x422ea4 = E00401000;
						 *0x422eb0 =  *0x423700;
						 *0x422eb4 = _t25;
						 *0x422ec4 = 0x4091f4;
						if(RegisterClassA(0x422ea0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoA(0x30, 0,  &_v16, 0);
						 *0x41fce8 = CreateWindowExA(0x80, 0x4091f4, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x423700, 0);
						goto L21;
					}
				} else {
					_t71 =  *(_t76 + 0x48);
					if(_t71 == 0) {
						goto L16;
					}
					_t74 = 0x4226a0;
					E00405BE0( *((intOrPtr*)(_t76 + 0x44)), _t71,  *((intOrPtr*)(_t76 + 0x4c)) +  *0x423738, 0x4226a0, 0);
					_t57 =  *0x4226a0; // 0x43
					if(_t57 == 0) {
						goto L16;
					}
					if(_t57 == 0x22) {
						_t74 = 0x4226a1;
						 *((char*)(E00405796(0x4226a1, 0x22))) = 0;
					}
					_t59 = lstrlenA(_t74) + _t74 - 4;
					if(_t59 <= _t74 || lstrcmpiA(_t59, ?str?) != 0) {
						L15:
						E00405CF9(_t80, E0040576B(_t74));
						goto L16;
					} else {
						_t63 = GetFileAttributesA(_t74);
						if(_t63 == 0xffffffff) {
							L14:
							E004057B2(_t74);
							goto L15;
						}
						_t92 = _t63 & 0x00000010;
						if((_t63 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}


























                                                          0x0040367f
                                                          0x00403688
                                                          0x0040368f
                                                          0x00403691
                                                          0x004036a5
                                                          0x004036b7
                                                          0x004036be
                                                          0x004036c5
                                                          0x004036cb
                                                          0x004036d0
                                                          0x004036d6
                                                          0x004036e9
                                                          0x004036e9
                                                          0x004036f4
                                                          0x00403693
                                                          0x00403693
                                                          0x0040369e
                                                          0x0040369e
                                                          0x004036f9
                                                          0x00403703
                                                          0x0040370c
                                                          0x00403711
                                                          0x00403722
                                                          0x004037a9
                                                          0x004037b1
                                                          0x004037ba
                                                          0x004037ba
                                                          0x004037d0
                                                          0x004037d6
                                                          0x004037e4
                                                          0x00403865
                                                          0x0040386d
                                                          0x00403877
                                                          0x0040387c
                                                          0x00403882
                                                          0x0040390c
                                                          0x00403911
                                                          0x00403913
                                                          0x0040392f
                                                          0x00000000
                                                          0x0040392f
                                                          0x00403915
                                                          0x0040391b
                                                          0x00403923
                                                          0x00403923
                                                          0x00000000
                                                          0x0040391b
                                                          0x00403890
                                                          0x0040389b
                                                          0x004038a0
                                                          0x004038a2
                                                          0x004038a9
                                                          0x004038a9
                                                          0x004038b4
                                                          0x004038bc
                                                          0x004038be
                                                          0x004038c0
                                                          0x004038c9
                                                          0x004038cc
                                                          0x004038d2
                                                          0x004038d2
                                                          0x004038d8
                                                          0x004038f1
                                                          0x00403902
                                                          0x00000000
                                                          0x00403907
                                                          0x0040386f
                                                          0x00403871
                                                          0x00000000
                                                          0x004037e6
                                                          0x004037e6
                                                          0x004037f2
                                                          0x004037fc
                                                          0x00403802
                                                          0x00403807
                                                          0x00403816
                                                          0x00403934
                                                          0x00403934
                                                          0x00000000
                                                          0x00403934
                                                          0x00403825
                                                          0x00403860
                                                          0x00000000
                                                          0x00403860
                                                          0x00403728
                                                          0x00403728
                                                          0x0040372d
                                                          0x00000000
                                                          0x00000000
                                                          0x00403737
                                                          0x00403747
                                                          0x0040374c
                                                          0x00403753
                                                          0x00000000
                                                          0x00000000
                                                          0x00403757
                                                          0x00403759
                                                          0x00403766
                                                          0x00403766
                                                          0x0040376e
                                                          0x00403774
                                                          0x0040379c
                                                          0x004037a4
                                                          0x00000000
                                                          0x00403786
                                                          0x00403787
                                                          0x00403790
                                                          0x00403796
                                                          0x00403797
                                                          0x00000000
                                                          0x00403797
                                                          0x00403792
                                                          0x00403794
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00403794
                                                          0x00403774

                                                          APIs
                                                            • Part of subcall function 00406092: GetModuleHandleA.KERNEL32(?,?,?,00403143,00000009), ref: 004060A4
                                                            • Part of subcall function 00406092: GetProcAddress.KERNEL32(00000000,?), ref: 004060BF
                                                          • GetUserDefaultUILanguage.KERNELBASE(00000002,74D0FA90,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe",00000000), ref: 00403693
                                                            • Part of subcall function 00405C57: wsprintfA.USER32 ref: 00405C64
                                                          • lstrcatA.KERNEL32(1033,Staalbrylluppets Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Staalbrylluppets Setup: Installing,00000000,00000002,74D0FA90,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe",00000000), ref: 004036F4
                                                          • lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\Pacifisterne\Automatcafeer,1033,Staalbrylluppets Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Staalbrylluppets Setup: Installing,00000000,00000002,74D0FA90), ref: 00403769
                                                          • lstrcmpiA.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\Pacifisterne\Automatcafeer,1033,Staalbrylluppets Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Staalbrylluppets Setup: Installing,00000000), ref: 0040377C
                                                          • GetFileAttributesA.KERNEL32(Call), ref: 00403787
                                                          • LoadImageA.USER32 ref: 004037D0
                                                          • RegisterClassA.USER32 ref: 0040380D
                                                          • SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403825
                                                          • CreateWindowExA.USER32 ref: 0040385A
                                                          • ShowWindow.USER32(00000005,00000000), ref: 00403890
                                                          • GetClassInfoA.USER32 ref: 004038BC
                                                          • GetClassInfoA.USER32 ref: 004038C9
                                                          • RegisterClassA.USER32 ref: 004038D2
                                                          • DialogBoxParamA.USER32 ref: 004038F1
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
                                                          • String ID: "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Pacifisterne\Automatcafeer$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$Staalbrylluppets Setup: Installing$_Nb
                                                          • API String ID: 606308-3588109407
                                                          • Opcode ID: e4151876de315e89be32e480170f8b472b72c03f6efbd502ccd32cfa15b0bd58
                                                          • Instruction ID: cdcda0c5d6d895e27caec97b3fe99e3f57ebd92391a3aca4eab7d54baf018be6
                                                          • Opcode Fuzzy Hash: e4151876de315e89be32e480170f8b472b72c03f6efbd502ccd32cfa15b0bd58
                                                          • Instruction Fuzzy Hash: FA61C8B16442007ED620BF669D45F373AACEB44759F40447FF941B22E2C77CAD029A2D
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00402C66 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 182COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 355 402c66-402cb4 GetTickCount GetModuleFileNameA call 40596c 358 402cc0-402cee call 405cf9 call 4057b2 call 405cf9 GetFileSize 355->358 359 402cb6-402cbb 355->359 367 402cf4 358->367 368 402ddb-402de9 call 402c02 358->368 360 402e98-402e9c 359->360 369 402cf9-402d10 367->369 374 402deb-402dee 368->374 375 402e3e-402e43 368->375 372 402d12 369->372 373 402d14-402d1d call 40307b 369->373 372->373 381 402d23-402d2a 373->381 382 402e45-402e4d call 402c02 373->382 377 402df0-402e08 call 403091 call 40307b 374->377 378 402e12-402e3c GlobalAlloc call 403091 call 402e9f 374->378 375->360 377->375 401 402e0a-402e10 377->401 378->375 406 402e4f-402e60 378->406 385 402da6-402daa 381->385 386 402d2c-402d40 call 405927 381->386 382->375 391 402db4-402dba 385->391 392 402dac-402db3 call 402c02 385->392 386->391 404 402d42-402d49 386->404 397 402dc9-402dd3 391->397 398 402dbc-402dc6 call 406107 391->398 392->391 397->369 405 402dd9 397->405 398->397 401->375 401->378 404->391 410 402d4b-402d52 404->410 405->368 407 402e62 406->407 408 402e68-402e6d 406->408 407->408 411 402e6e-402e74 408->411 410->391 412 402d54-402d5b 410->412 411->411 413 402e76-402e91 SetFilePointer call 405927 411->413 412->391 414 402d5d-402d64 412->414 418 402e96 413->418 414->391 416 402d66-402d86 414->416 416->375 417 402d8c-402d90 416->417 419 402d92-402d96 417->419 420 402d98-402da0 417->420 418->360 419->405 419->420 420->391 421 402da2-402da4 420->421 421->391
                                                          C-Code - Quality: 80%
                                                          			E00402C66(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				signed int _t50;
				void* _t53;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				signed int _t65;
				signed int _t70;
				signed int _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				signed int _t85;
				signed int _t87;
				void* _t89;
				signed int _t90;
				signed int _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = "C:\\Users\\hardz\\Desktop\\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe";
				 *0x42370c = _t43 + 0x3e8;
				GetModuleFileNameA(0, "C:\\Users\\hardz\\Desktop\\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe", 0x400);
				_t89 = E0040596C(_t91, 0x80000000, 3);
				_v16 = _t89;
				 *0x409018 = _t89;
				if(_t89 == 0xffffffff) {
					return "Error launching installer";
				}
				_t92 = "C:\\Users\\hardz\\Desktop";
				E00405CF9("C:\\Users\\hardz\\Desktop", _t91);
				E00405CF9("Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe", E004057B2(_t92));
				_t50 = GetFileSize(_t89, 0);
				__eflags = _t50;
				 *0x4168c4 = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00402C02(1);
					__eflags =  *0x423714 - _t82;
					if( *0x423714 == _t82) {
						goto L29;
					}
					__eflags = _v8 - _t82;
					if(_v8 == _t82) {
						L28:
						_t53 = GlobalAlloc(0x40, _v24); // executed
						_t94 = _t53;
						E00403091( *0x423714 + 0x1c);
						_push(_v24);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff); // executed
						_t57 = E00402E9F(); // executed
						__eflags = _t57 - _v24;
						if(_t57 == _v24) {
							__eflags = _v44 & 0x00000001;
							 *0x423710 = _t94;
							 *0x423718 =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x42371c =  *0x42371c + 1;
								__eflags =  *0x42371c;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
								__eflags = _t85;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
							 *(_t94 + 0x3c) = _t60;
							E00405927(0x423720, _t94 + 4, 0x40);
							__eflags = 0;
							return 0;
						}
						goto L29;
					}
					E00403091( *0x40a8b8);
					_t65 = E0040307B( &_a4, 4);
					__eflags = _t65;
					if(_t65 == 0) {
						goto L29;
					}
					__eflags = _v12 - _a4;
					if(_v12 != _a4) {
						goto L29;
					}
					goto L28;
				} else {
					do {
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~( *0x423714) & 0x00007e00) + 0x200;
						__eflags = _t93 - _t70;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E0040307B(0x4168c8, _t90);
						__eflags = _t71;
						if(_t71 == 0) {
							E00402C02(1);
							L29:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x423714;
						if( *0x423714 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402C02(0);
							}
							goto L20;
						}
						E00405927( &_v44, 0x4168c8, 0x1c);
						_t77 = _v44;
						__eflags = _t77 & 0xfffffff0;
						if((_t77 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v40 - 0xdeadbeef;
						if(_v40 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v28 - 0x74736e49;
						if(_v28 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v32 - 0x74666f73;
						if(_v32 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v36 - 0x6c6c754e;
						if(_v36 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t77;
						_t87 =  *0x40a8b8; // 0xa306e
						 *0x4237a0 =  *0x4237a0 | _a4 & 0x00000002;
						_t80 = _v20;
						__eflags = _t80 - _t93;
						 *0x423714 = _t87;
						if(_t80 > _t93) {
							goto L29;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v8 = _v8 + 1;
							_t24 = _t80 - 4; // 0x409194
							_t93 = _t24;
							__eflags = _t90 - _t93;
							if(_t90 > _t93) {
								_t90 = _t93;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t93 -  *0x4168c4; // 0xa37a0
						if(__eflags < 0) {
							_v12 = E00406107(_v12, 0x4168c8, _t90);
						}
						 *0x40a8b8 =  *0x40a8b8 + _t90;
						_t93 = _t93 - _t90;
						__eflags = _t93;
					} while (_t93 > 0);
					_t82 = 0;
					__eflags = 0;
					goto L24;
				}
			}































                                                          0x00402c6e
                                                          0x00402c71
                                                          0x00402c74
                                                          0x00402c77
                                                          0x00402c7d
                                                          0x00402c8e
                                                          0x00402c93
                                                          0x00402ca6
                                                          0x00402cab
                                                          0x00402cae
                                                          0x00402cb4
                                                          0x00000000
                                                          0x00402cb6
                                                          0x00402cc1
                                                          0x00402cc7
                                                          0x00402cd8
                                                          0x00402cdf
                                                          0x00402ce5
                                                          0x00402ce7
                                                          0x00402cec
                                                          0x00402cee
                                                          0x00402ddb
                                                          0x00402ddd
                                                          0x00402de2
                                                          0x00402de9
                                                          0x00000000
                                                          0x00000000
                                                          0x00402deb
                                                          0x00402dee
                                                          0x00402e12
                                                          0x00402e17
                                                          0x00402e1d
                                                          0x00402e28
                                                          0x00402e2d
                                                          0x00402e30
                                                          0x00402e31
                                                          0x00402e32
                                                          0x00402e34
                                                          0x00402e39
                                                          0x00402e3c
                                                          0x00402e4f
                                                          0x00402e53
                                                          0x00402e5b
                                                          0x00402e60
                                                          0x00402e62
                                                          0x00402e62
                                                          0x00402e62
                                                          0x00402e6a
                                                          0x00402e6a
                                                          0x00402e6d
                                                          0x00402e6e
                                                          0x00402e6e
                                                          0x00402e71
                                                          0x00402e73
                                                          0x00402e73
                                                          0x00402e73
                                                          0x00402e7d
                                                          0x00402e83
                                                          0x00402e91
                                                          0x00402e96
                                                          0x00000000
                                                          0x00402e96
                                                          0x00000000
                                                          0x00402e3c
                                                          0x00402df6
                                                          0x00402e01
                                                          0x00402e06
                                                          0x00402e08
                                                          0x00000000
                                                          0x00000000
                                                          0x00402e0d
                                                          0x00402e10
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00402cf4
                                                          0x00402cf9
                                                          0x00402cfe
                                                          0x00402d02
                                                          0x00402d09
                                                          0x00402d0e
                                                          0x00402d10
                                                          0x00402d12
                                                          0x00402d12
                                                          0x00402d16
                                                          0x00402d1b
                                                          0x00402d1d
                                                          0x00402e47
                                                          0x00402e3e
                                                          0x00000000
                                                          0x00402e3e
                                                          0x00402d23
                                                          0x00402d2a
                                                          0x00402da6
                                                          0x00402daa
                                                          0x00402dae
                                                          0x00402db3
                                                          0x00000000
                                                          0x00402daa
                                                          0x00402d33
                                                          0x00402d38
                                                          0x00402d3b
                                                          0x00402d40
                                                          0x00000000
                                                          0x00000000
                                                          0x00402d42
                                                          0x00402d49
                                                          0x00000000
                                                          0x00000000
                                                          0x00402d4b
                                                          0x00402d52
                                                          0x00000000
                                                          0x00000000
                                                          0x00402d54
                                                          0x00402d5b
                                                          0x00000000
                                                          0x00000000
                                                          0x00402d5d
                                                          0x00402d64
                                                          0x00000000
                                                          0x00000000
                                                          0x00402d66
                                                          0x00402d6c
                                                          0x00402d75
                                                          0x00402d7b
                                                          0x00402d7e
                                                          0x00402d80
                                                          0x00402d86
                                                          0x00000000
                                                          0x00000000
                                                          0x00402d8c
                                                          0x00402d90
                                                          0x00402d98
                                                          0x00402d98
                                                          0x00402d9b
                                                          0x00402d9b
                                                          0x00402d9e
                                                          0x00402da0
                                                          0x00402da2
                                                          0x00402da2
                                                          0x00000000
                                                          0x00402da0
                                                          0x00402d92
                                                          0x00402d96
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00402db4
                                                          0x00402db4
                                                          0x00402dba
                                                          0x00402dc6
                                                          0x00402dc6
                                                          0x00402dc9
                                                          0x00402dcf
                                                          0x00402dd1
                                                          0x00402dd1
                                                          0x00402dd9
                                                          0x00402dd9
                                                          0x00000000
                                                          0x00402dd9

                                                          APIs
                                                          • GetTickCount.KERNEL32 ref: 00402C77
                                                          • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,00000400), ref: 00402C93
                                                            • Part of subcall function 0040596C: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,80000000,00000003), ref: 00405970
                                                            • Part of subcall function 0040596C: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405992
                                                          • GetFileSize.KERNEL32(00000000,00000000,Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,80000000,00000003), ref: 00402CDF
                                                          Strings
                                                          • Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, xrefs: 00402CD3
                                                          • Null, xrefs: 00402D5D
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 00402C6D
                                                          • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E3E
                                                          • C:\Users\user\Desktop, xrefs: 00402CC1, 00402CC6, 00402CCC
                                                          • Error launching installer, xrefs: 00402CB6
                                                          • Inst, xrefs: 00402D4B
                                                          • n0, xrefs: 00402D6C, 00402DC9
                                                          • soft, xrefs: 00402D54
                                                          • C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, xrefs: 00402C7D, 00402C8C, 00402CA0, 00402CC0
                                                          • "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe", xrefs: 00402C66
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: File$AttributesCountCreateModuleNameSizeTick
                                                          • String ID: "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe$n0$soft
                                                          • API String ID: 4283519449-2646200633
                                                          • Opcode ID: 3f665217ac2245ad92c498c6fa1e551097c863ebe5e03bc44dd447b4a8322165
                                                          • Instruction ID: 1839f4375b44da3097aca9d4a8c6c84b0463c2d100b7a2d698c12080187f488f
                                                          • Opcode Fuzzy Hash: 3f665217ac2245ad92c498c6fa1e551097c863ebe5e03bc44dd447b4a8322165
                                                          • Instruction Fuzzy Hash: BF51B6B1A41214ABDF109F65DE89B9E7AB4EF00355F14403BF904B62D1C7BC9E418B9D
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00401751 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147stringtimeCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          C-Code - Quality: 61%
                                                          			E00401751(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				CHAR* _t83;
				void* _t85;

				_t75 = __ebx;
				_t82 = E00402A3A(0x31);
				 *(_t85 - 8) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x28) & 0x00000007;
				_t33 = E004057D8(_t82);
				_push(_t82);
				_t83 = "Call";
				if(_t33 == 0) {
					lstrcatA(E0040576B(E00405CF9(_t83, "C:\\Users\\hardz\\Pacifisterne\\Automatcafeer\\Syntaksgenkendelsernes\\Temposkifterne")), ??);
				} else {
					E00405CF9();
				}
				E00405F64(_t83);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E00405FFD(_t83);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x1c);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E00405947(_t83);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E0040596C(_t83, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 0xc) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E00404F12(0xffffffe2,  *(_t85 - 8));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x423788;
						goto L32;
					} else {
						E00405CF9(0x409be8, 0x424000);
						E00405CF9(0x424000, _t83);
						E00405D1B(_t75, 0x409be8, _t83, "C:\Users\hardz\AppData\Local\Temp\nsgFEE3.tmp\System.dll",  *((intOrPtr*)(_t85 - 0x14)));
						E00405CF9(0x424000, 0x409be8);
						_t62 = E004054EF("C:\Users\hardz\AppData\Local\Temp\nsgFEE3.tmp\System.dll",  *(_t85 - 0x28) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x423788 =  &( *0x423788->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(_t83);
								_push(0xfffffffa);
								E00404F12();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E00404F12(0xffffffea,  *(_t85 - 8));
				 *0x4237b4 =  *0x4237b4 + 1;
				_push(_t75);
				_push(_t75);
				_push( *(_t85 - 0xc));
				_push( *((intOrPtr*)(_t85 - 0x20)));
				_t43 = E00402E9F(); // executed
				 *0x4237b4 =  *0x4237b4 - 1;
				__eflags =  *(_t85 - 0x1c) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x1c) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 0xc), _t85 - 0x1c, _t75, _t85 - 0x1c); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x18)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t85 - 0xc)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E00405D1B(_t75, _t80, _t83, _t83, 0xffffffee);
					} else {
						E00405D1B(_t75, _t80, _t83, _t83, 0xffffffe9);
						lstrcatA(_t83,  *(_t85 - 8));
					}
					_push(0x200010);
					_push(_t83);
					E004054EF();
					goto L29;
				}
				goto L33;
			}

















                                                          0x00401751
                                                          0x00401758
                                                          0x00401761
                                                          0x00401764
                                                          0x00401767
                                                          0x0040176c
                                                          0x0040176d
                                                          0x00401774
                                                          0x00401790
                                                          0x00401776
                                                          0x00401777
                                                          0x00401777
                                                          0x00401796
                                                          0x004017a0
                                                          0x004017a0
                                                          0x004017a4
                                                          0x004017a7
                                                          0x004017ac
                                                          0x004017ae
                                                          0x004017b0
                                                          0x004017b5
                                                          0x004017b5
                                                          0x004017c0
                                                          0x004017c0
                                                          0x004017d1
                                                          0x004017d3
                                                          0x004017d3
                                                          0x004017d4
                                                          0x004017d4
                                                          0x004017d7
                                                          0x004017da
                                                          0x004017dd
                                                          0x004017dd
                                                          0x004017e4
                                                          0x004017f3
                                                          0x004017f8
                                                          0x004017fb
                                                          0x004017fe
                                                          0x00000000
                                                          0x00000000
                                                          0x00401800
                                                          0x00401803
                                                          0x0040185d
                                                          0x00401862
                                                          0x004015a8
                                                          0x004026a6
                                                          0x004026a6
                                                          0x004028cf
                                                          0x004028d2
                                                          0x004028d2
                                                          0x00000000
                                                          0x00401805
                                                          0x0040180b
                                                          0x00401816
                                                          0x00401823
                                                          0x0040182e
                                                          0x00401844
                                                          0x00401844
                                                          0x00401847
                                                          0x00000000
                                                          0x0040184d
                                                          0x0040184d
                                                          0x0040184e
                                                          0x0040186b
                                                          0x004028d8
                                                          0x004028d8
                                                          0x004028d8
                                                          0x00401850
                                                          0x00401850
                                                          0x00401851
                                                          0x00401492
                                                          0x0040226e
                                                          0x0040226e
                                                          0x0040226e
                                                          0x0040184e
                                                          0x00401847
                                                          0x004028da
                                                          0x004028de
                                                          0x004028de
                                                          0x0040187b
                                                          0x00401880
                                                          0x00401886
                                                          0x00401887
                                                          0x00401888
                                                          0x0040188b
                                                          0x0040188e
                                                          0x00401893
                                                          0x00401899
                                                          0x0040189d
                                                          0x0040189f
                                                          0x004018a7
                                                          0x004018b3
                                                          0x004018a1
                                                          0x004018a1
                                                          0x004018a5
                                                          0x00000000
                                                          0x00000000
                                                          0x004018a5
                                                          0x004018bc
                                                          0x004018c2
                                                          0x004018c4
                                                          0x00000000
                                                          0x004018ca
                                                          0x004018ca
                                                          0x004018cd
                                                          0x004018e5
                                                          0x004018cf
                                                          0x004018d2
                                                          0x004018db
                                                          0x004018db
                                                          0x004018ea
                                                          0x004018ef
                                                          0x00402269
                                                          0x00000000
                                                          0x00402269
                                                          0x00000000

                                                          APIs
                                                          • lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne,00000000,00000000,00000031), ref: 00401790
                                                          • CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne,00000000,00000000,00000031), ref: 004017BA
                                                            • Part of subcall function 00405CF9: lstrcpynA.KERNEL32(?,?,00000400,00403187,00422F00,NSIS Error), ref: 00405D06
                                                            • Part of subcall function 00404F12: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4B
                                                            • Part of subcall function 00404F12: lstrlenA.KERNEL32(00402FCF,Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5B
                                                            • Part of subcall function 00404F12: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,00402FCF,00402FCF,Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,00000000,0040E8C0,00000000), ref: 00404F6E
                                                            • Part of subcall function 00404F12: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll), ref: 00404F80
                                                            • Part of subcall function 00404F12: SendMessageA.USER32 ref: 00404FA6
                                                            • Part of subcall function 00404F12: SendMessageA.USER32 ref: 00404FC0
                                                            • Part of subcall function 00404F12: SendMessageA.USER32 ref: 00404FCE
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                          • String ID: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp$C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll$C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne$Call
                                                          • API String ID: 1941528284-2872570304
                                                          • Opcode ID: 0a1543a085f6924ab6246bab24d9f17f2b644b182a85906dbf2429315c048b63
                                                          • Instruction ID: dfa66b7161a0f16b13ad00a25904a83b243dedeb6ee7557d1be3b523159fd244
                                                          • Opcode Fuzzy Hash: 0a1543a085f6924ab6246bab24d9f17f2b644b182a85906dbf2429315c048b63
                                                          • Instruction Fuzzy Hash: 5641D572910515BACF107BB5CC85EAF3679EF45329B20823BF521F20E2D63C4A419B6D
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00404F12 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73stringwindowCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 620 404f12-404f27 621 404fdd-404fe1 620->621 622 404f2d-404f3f 620->622 623 404f41-404f45 call 405d1b 622->623 624 404f4a-404f56 lstrlenA 622->624 623->624 625 404f73-404f77 624->625 626 404f58-404f68 lstrlenA 624->626 629 404f86-404f8a 625->629 630 404f79-404f80 SetWindowTextA 625->630 626->621 628 404f6a-404f6e lstrcatA 626->628 628->625 631 404fd0-404fd2 629->631 632 404f8c-404fce SendMessageA * 3 629->632 630->629 631->621 633 404fd4-404fd7 631->633 632->631 633->621
                                                          C-Code - Quality: 100%
                                                          			E00404F12(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x422ee4; // 0x10434
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x4237b4;
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E00405D1B(0, _t39, 0x41f4e8, 0x41f4e8, _a4);
					}
					_t26 = lstrlenA(0x41f4e8);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x422ec8, 0x41f4e8); // executed
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x41f4e8;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0); // executed
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52); // executed
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0); // executed
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x41f4e8)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x41f4e8, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

















                                                          0x00404f18
                                                          0x00404f24
                                                          0x00404f27
                                                          0x00404f2d
                                                          0x00404f39
                                                          0x00404f3c
                                                          0x00404f3f
                                                          0x00404f45
                                                          0x00404f45
                                                          0x00404f4b
                                                          0x00404f53
                                                          0x00404f56
                                                          0x00404f73
                                                          0x00404f77
                                                          0x00404f80
                                                          0x00404f80
                                                          0x00404f8a
                                                          0x00404f93
                                                          0x00404f9f
                                                          0x00404fa6
                                                          0x00404faa
                                                          0x00404fad
                                                          0x00404fc0
                                                          0x00404fce
                                                          0x00404fce
                                                          0x00404fd2
                                                          0x00404fd4
                                                          0x00404fd7
                                                          0x00000000
                                                          0x00404fd7
                                                          0x00404f58
                                                          0x00404f60
                                                          0x00404f68
                                                          0x00404f6e
                                                          0x00000000
                                                          0x00404f6e
                                                          0x00404f68
                                                          0x00404f56
                                                          0x00404fe1

                                                          APIs
                                                          • lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4B
                                                          • lstrlenA.KERNEL32(00402FCF,Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5B
                                                          • lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,00402FCF,00402FCF,Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,00000000,0040E8C0,00000000), ref: 00404F6E
                                                          • SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll), ref: 00404F80
                                                          • SendMessageA.USER32 ref: 00404FA6
                                                          • SendMessageA.USER32 ref: 00404FC0
                                                          • SendMessageA.USER32 ref: 00404FCE
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                          • String ID: Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll
                                                          • API String ID: 2531174081-142170504
                                                          • Opcode ID: 7807df4f356ea8157868d104e1ce756945f1af52411ab180d12a31a7a846d162
                                                          • Instruction ID: 5a9a404093729f8c7a4ed64dcb73daf90ff889549f225b9df3951733f5861a8d
                                                          • Opcode Fuzzy Hash: 7807df4f356ea8157868d104e1ce756945f1af52411ab180d12a31a7a846d162
                                                          • Instruction Fuzzy Hash: EB219DB1A00119BADF119FA5DD84ADEBFB9EF44354F14807AF904B6290C7788E41DBA8
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 004053D8 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 634 4053d8-405423 CreateDirectoryA 635 405425-405427 634->635 636 405429-405436 GetLastError 634->636 637 405450-405452 635->637 636->637 638 405438-40544c SetFileSecurityA 636->638 638->635 639 40544e GetLastError 638->639 639->637
                                                          C-Code - Quality: 100%
                                                          			E004053D8(CHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x407374;
				_v36.Group = 0x407374;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x407364;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryA(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityA(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}







                                                          0x004053e3
                                                          0x004053e7
                                                          0x004053ea
                                                          0x004053f0
                                                          0x004053f4
                                                          0x004053f8
                                                          0x00405400
                                                          0x00405407
                                                          0x0040540d
                                                          0x00405414
                                                          0x0040541b
                                                          0x00405423
                                                          0x00405425
                                                          0x00000000
                                                          0x00405425
                                                          0x0040542f
                                                          0x00405436
                                                          0x0040544c
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040544e
                                                          0x00405452

                                                          APIs
                                                          • CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040541B
                                                          • GetLastError.KERNEL32 ref: 0040542F
                                                          • SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405444
                                                          • GetLastError.KERNEL32 ref: 0040544E
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                          • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$ds@$ts@
                                                          • API String ID: 3449924974-2841175888
                                                          • Opcode ID: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
                                                          • Instruction ID: 5d613d5f07efa900d759e60f8f8ec78c4c71b6ffd2fe208e339ff175f81ef67f
                                                          • Opcode Fuzzy Hash: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
                                                          • Instruction Fuzzy Hash: F3010871D14259EADF119FA0D9487EFBFB8EB04315F00417AE904B6280D378A644CFAA
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00406024 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 640 406024-406044 GetSystemDirectoryA 641 406046 640->641 642 406048-40604a 640->642 641->642 643 40605a-40605c 642->643 644 40604c-406054 642->644 646 40605d-40608f wsprintfA LoadLibraryExA 643->646 644->643 645 406056-406058 644->645 645->646
                                                          C-Code - Quality: 100%
                                                          			E00406024(intOrPtr _a4) {
				char _v292;
				int _t10;
				struct HINSTANCE__* _t14;
				void* _t16;
				void* _t21;

				_t10 = GetSystemDirectoryA( &_v292, 0x104);
				if(_t10 > 0x104) {
					_t10 = 0;
				}
				if(_t10 == 0 ||  *((char*)(_t21 + _t10 - 0x121)) == 0x5c) {
					_t16 = 1;
				} else {
					_t16 = 0;
				}
				_t5 = _t16 + 0x409014; // 0x5c
				wsprintfA(_t21 + _t10 - 0x120, "%s%s.dll", _t5, _a4);
				_t14 = LoadLibraryExA( &_v292, 0, 8); // executed
				return _t14;
			}








                                                          0x0040603b
                                                          0x00406044
                                                          0x00406046
                                                          0x00406046
                                                          0x0040604a
                                                          0x0040605c
                                                          0x00406056
                                                          0x00406056
                                                          0x00406056
                                                          0x00406060
                                                          0x00406074
                                                          0x00406088
                                                          0x0040608f

                                                          APIs
                                                          • GetSystemDirectoryA.KERNEL32 ref: 0040603B
                                                          • wsprintfA.USER32 ref: 00406074
                                                          • LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406088
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: DirectoryLibraryLoadSystemwsprintf
                                                          • String ID: %s%s.dll$UXTHEME$\
                                                          • API String ID: 2200240437-4240819195
                                                          • Opcode ID: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
                                                          • Instruction ID: 72752c577983536edbae7b7a4b2c1439e1101fa4b93fa8d0208d5a4e16dde88a
                                                          • Opcode Fuzzy Hash: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
                                                          • Instruction Fuzzy Hash: E6F0FC30A40109AADB14E764DC0DFEB365CAB09305F140576A546E11D1D578E9258B69
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00402E9F Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 647 402e9f-402eb3 648 402eb5 647->648 649 402ebc-402ec4 647->649 648->649 650 402ec6 649->650 651 402ecb-402ed0 649->651 650->651 652 402ee0-402eed call 40307b 651->652 653 402ed2-402edb call 403091 651->653 657 403032 652->657 658 402ef3-402ef7 652->658 653->652 661 403034-403035 657->661 659 40301b-40301d 658->659 660 402efd-402f1d GetTickCount call 406175 658->660 662 403066-40306a 659->662 663 40301f-403022 659->663 671 403071 660->671 673 402f23-402f2b 660->673 665 403074-403078 661->665 666 403037-40303d 662->666 667 40306c 662->667 668 403024 663->668 669 403027-403030 call 40307b 663->669 674 403042-403050 call 40307b 666->674 675 40303f 666->675 667->671 668->669 669->657 681 40306e 669->681 671->665 678 402f30-402f3e call 40307b 673->678 679 402f2d 673->679 674->657 683 403052-40305e call 405a13 674->683 675->674 678->657 686 402f44-402f4d 678->686 679->678 681->671 690 403060-403063 683->690 691 403017-403019 683->691 687 402f53-402f70 call 406195 686->687 693 403013-403015 687->693 694 402f76-402f8d GetTickCount 687->694 690->662 691->661 693->661 695 402fd2-402fd4 694->695 696 402f8f-402f97 694->696 699 402fd6-402fda 695->699 700 403007-40300b 695->700 697 402f99-402f9d 696->697 698 402f9f-402fcf MulDiv wsprintfA call 404f12 696->698 697->695 697->698 698->695 703 402fdc-402fe1 call 405a13 699->703 704 402fef-402ff5 699->704 700->673 701 403011 700->701 701->671 709 402fe6-402fe8 703->709 705 402ffb-402fff 704->705 705->687 708 403005 705->708 708->671 709->691 710 402fea-402fed 709->710 710->705
                                                          C-Code - Quality: 94%
                                                          			E00402E9F(int _a4, intOrPtr _a8, intOrPtr _a12, int _a16, signed char _a19) {
				signed int _v8;
				int _v12;
				long _v16;
				intOrPtr _v20;
				char _v84;
				void* _t59;
				intOrPtr _t69;
				long _t70;
				void* _t71;
				intOrPtr _t81;
				intOrPtr _t86;
				long _t89;
				signed int _t90;
				int _t91;
				int _t92;
				intOrPtr _t93;
				void* _t94;
				void* _t95;

				_t90 = _a16;
				_t86 = _a12;
				_v12 = _t90;
				if(_t86 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_t81 = _t86;
				if(_t86 == 0) {
					_t81 = 0x40e8c0;
				}
				_t56 = _a4;
				if(_a4 >= 0) {
					E00403091( *0x423758 + _t56);
				}
				if(E0040307B( &_a16, 4) == 0) {
					L33:
					_push(0xfffffffd);
					goto L34;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t86 == 0) {
							while(_a16 > 0) {
								_t91 = _v12;
								if(_a16 < _t91) {
									_t91 = _a16;
								}
								if(E0040307B(0x40a8c0, _t91) == 0) {
									goto L33;
								} else {
									if(E00405A13(_a8, 0x40a8c0, _t91) == 0) {
										L28:
										_push(0xfffffffe);
										L34:
										_pop(_t59);
										return _t59;
									}
									_v8 = _v8 + _t91;
									_a16 = _a16 - _t91;
									continue;
								}
							}
							L43:
							return _v8;
						}
						if(_a16 < _t90) {
							_t90 = _a16;
						}
						if(E0040307B(_t86, _t90) != 0) {
							_v8 = _t90;
							goto L43;
						} else {
							goto L33;
						}
					}
					_v16 = GetTickCount();
					E00406175(0x40a830);
					_t13 =  &_a16;
					 *_t13 = _a16 & 0x7fffffff;
					_a4 = _a16;
					if( *_t13 <= 0) {
						goto L43;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t92 = 0x4000;
						if(_a16 < 0x4000) {
							_t92 = _a16;
						}
						if(E0040307B(0x40a8c0, _t92) == 0) {
							goto L33;
						}
						_a16 = _a16 - _t92;
						 *0x40a848 = 0x40a8c0;
						 *0x40a84c = _t92;
						while(1) {
							 *0x40a850 = _t81;
							 *0x40a854 = _v12; // executed
							_t69 = E00406195(0x40a830); // executed
							_v20 = _t69;
							if(_t69 < 0) {
								break;
							}
							_t93 =  *0x40a850; // 0x40e8c0
							_t94 = _t93 - _t81;
							_t70 = GetTickCount();
							_t89 = _t70;
							if(( *0x4237b4 & 0x00000001) != 0 && (_t70 - _v16 > 0xc8 || _a16 == 0)) {
								wsprintfA( &_v84, "... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t95 = _t95 + 0xc;
								E00404F12(0,  &_v84);
								_v16 = _t89;
							}
							if(_t94 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L43;
							} else {
								if(_a12 != 0) {
									_v8 = _v8 + _t94;
									_v12 = _v12 - _t94;
									_t81 =  *0x40a850; // 0x40e8c0
									L23:
									if(_v20 != 1) {
										continue;
									}
									goto L43;
								}
								_t71 = E00405A13(_a8, _t81, _t94); // executed
								if(_t71 == 0) {
									goto L28;
								}
								_v8 = _v8 + _t94;
								goto L23;
							}
						}
						_push(0xfffffffc);
						goto L34;
					}
					goto L33;
				}
			}





















                                                          0x00402ea7
                                                          0x00402eab
                                                          0x00402eae
                                                          0x00402eb3
                                                          0x00402eb5
                                                          0x00402eb5
                                                          0x00402ebc
                                                          0x00402ec0
                                                          0x00402ec4
                                                          0x00402ec6
                                                          0x00402ec6
                                                          0x00402ecb
                                                          0x00402ed0
                                                          0x00402edb
                                                          0x00402edb
                                                          0x00402eed
                                                          0x00403032
                                                          0x00403032
                                                          0x00000000
                                                          0x00402ef3
                                                          0x00402ef7
                                                          0x0040301d
                                                          0x00403066
                                                          0x00403037
                                                          0x0040303d
                                                          0x0040303f
                                                          0x0040303f
                                                          0x00403050
                                                          0x00000000
                                                          0x00403052
                                                          0x0040305e
                                                          0x00403017
                                                          0x00403017
                                                          0x00403034
                                                          0x00403034
                                                          0x00000000
                                                          0x00403034
                                                          0x00403060
                                                          0x00403063
                                                          0x00000000
                                                          0x00403063
                                                          0x00403050
                                                          0x00403071
                                                          0x00000000
                                                          0x00403071
                                                          0x00403022
                                                          0x00403024
                                                          0x00403024
                                                          0x00403030
                                                          0x0040306e
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00403030
                                                          0x00402f08
                                                          0x00402f0b
                                                          0x00402f10
                                                          0x00402f10
                                                          0x00402f1a
                                                          0x00402f1d
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00402f23
                                                          0x00402f23
                                                          0x00402f23
                                                          0x00402f2b
                                                          0x00402f2d
                                                          0x00402f2d
                                                          0x00402f3e
                                                          0x00000000
                                                          0x00000000
                                                          0x00402f44
                                                          0x00402f47
                                                          0x00402f4d
                                                          0x00402f53
                                                          0x00402f5b
                                                          0x00402f61
                                                          0x00402f66
                                                          0x00402f6d
                                                          0x00402f70
                                                          0x00000000
                                                          0x00000000
                                                          0x00402f76
                                                          0x00402f7c
                                                          0x00402f7e
                                                          0x00402f8b
                                                          0x00402f8d
                                                          0x00402fbb
                                                          0x00402fc1
                                                          0x00402fca
                                                          0x00402fcf
                                                          0x00402fcf
                                                          0x00402fd4
                                                          0x0040300b
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00402fd6
                                                          0x00402fda
                                                          0x00402fef
                                                          0x00402ff2
                                                          0x00402ff5
                                                          0x00402ffb
                                                          0x00402fff
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00403005
                                                          0x00402fe1
                                                          0x00402fe8
                                                          0x00000000
                                                          0x00000000
                                                          0x00402fea
                                                          0x00000000
                                                          0x00402fea
                                                          0x00402fd4
                                                          0x00403013
                                                          0x00000000
                                                          0x00403013
                                                          0x00000000
                                                          0x00402f23

                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: CountTick$wsprintf
                                                          • String ID: ... %d%%
                                                          • API String ID: 551687249-2449383134
                                                          • Opcode ID: 829153be18cd8cbb103d54c4c3cf61b016bad4870cd0a662c9aadeacd2aa24dd
                                                          • Instruction ID: 4ab2a5a1bcd3fb7fa9d72e81aa521510b391fe67da8672e6f00875cd24a8b3cf
                                                          • Opcode Fuzzy Hash: 829153be18cd8cbb103d54c4c3cf61b016bad4870cd0a662c9aadeacd2aa24dd
                                                          • Instruction Fuzzy Hash: 7D518F729022199BDF10DF65DA08A9F7BB8AF40795F14413BF800B72C4C7789E51DBAA
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00402364 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71registrystringCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 711 402364-4023aa call 402b2f call 402a3a * 2 RegCreateKeyExA 718 4023b0-4023b8 711->718 719 4028cf-4028de 711->719 721 4023c8-4023cb 718->721 722 4023ba-4023c7 call 402a3a lstrlenA 718->722 723 4023db-4023de 721->723 724 4023cd-4023da call 402a1d 721->724 722->721 728 4023e0-4023ea call 402e9f 723->728 729 4023ef-402403 RegSetValueExA 723->729 724->723 728->729 733 402405 729->733 734 402408-4024de RegCloseKey 729->734 733->734 734->719 736 4026a6-4026ad 734->736 736->719
                                                          C-Code - Quality: 85%
                                                          			E00402364(void* __eax) {
				void* _t15;
				char* _t18;
				int _t19;
				long _t22;
				char _t24;
				int _t27;
				intOrPtr _t35;
				void* _t37;

				_t15 = E00402B2F(__eax);
				_t35 =  *((intOrPtr*)(_t37 - 0x18));
				 *(_t37 - 0x34) =  *(_t37 - 0x14);
				 *(_t37 - 0x38) = E00402A3A(2);
				_t18 = E00402A3A(0x11);
				 *(_t37 - 4) = 1;
				_t19 = RegCreateKeyExA(_t15, _t18, _t27, _t27, _t27,  *0x4237b0 | 0x00000002, _t27, _t37 + 8, _t27); // executed
				if(_t19 == 0) {
					if(_t35 == 1) {
						E00402A3A(0x23);
						_t19 = lstrlenA(0x409be8) + 1;
					}
					if(_t35 == 4) {
						_t24 = E00402A1D(3);
						 *0x409be8 = _t24;
						_t19 = _t35;
					}
					if(_t35 == 3) {
						_t19 = E00402E9F( *((intOrPtr*)(_t37 - 0x1c)), _t27, 0x409be8, 0xc00);
					}
					_t22 = RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x38), _t27,  *(_t37 - 0x34), 0x409be8, _t19); // executed
					if(_t22 == 0) {
						 *(_t37 - 4) = _t27;
					}
					_push( *(_t37 + 8));
					RegCloseKey();
				}
				 *0x423788 =  *0x423788 +  *(_t37 - 4);
				return 0;
			}











                                                          0x00402365
                                                          0x0040236a
                                                          0x00402374
                                                          0x0040237e
                                                          0x00402381
                                                          0x0040239b
                                                          0x004023a2
                                                          0x004023aa
                                                          0x004023b8
                                                          0x004023bc
                                                          0x004023c7
                                                          0x004023c7
                                                          0x004023cb
                                                          0x004023cf
                                                          0x004023d5
                                                          0x004023da
                                                          0x004023da
                                                          0x004023de
                                                          0x004023ea
                                                          0x004023ea
                                                          0x004023fb
                                                          0x00402403
                                                          0x00402405
                                                          0x00402405
                                                          0x00402408
                                                          0x004024d8
                                                          0x004024d8
                                                          0x004028d2
                                                          0x004028de

                                                          APIs
                                                          • RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023A2
                                                          • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023C2
                                                          • RegSetValueExA.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023FB
                                                          • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024D8
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: CloseCreateValuelstrlen
                                                          • String ID: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp
                                                          • API String ID: 1356686001-3143865396
                                                          • Opcode ID: 1dca66d2d1093a5130de9b07e79a19b0c80f7b3ba9a11136c7381f0e18dd9290
                                                          • Instruction ID: 26fcae0a7b2a502e926faea7c6e927eea7b3aae3134fdb689c9e3a18d41500d2
                                                          • Opcode Fuzzy Hash: 1dca66d2d1093a5130de9b07e79a19b0c80f7b3ba9a11136c7381f0e18dd9290
                                                          • Instruction Fuzzy Hash: 3E1145B1E00108BFEB10AFA5EE89EAF767DEB54358F10403AF505B71D1D6B85D419B28
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040599B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 737 40599b-4059a5 738 4059a6-4059d1 GetTickCount GetTempFileNameA 737->738 739 4059e0-4059e2 738->739 740 4059d3-4059d5 738->740 742 4059da-4059dd 739->742 740->738 741 4059d7 740->741 741->742
                                                          C-Code - Quality: 100%
                                                          			E0040599B(char _a4, intOrPtr _a6, CHAR* _a8) {
				char _t11;
				signed int _t12;
				int _t15;
				signed int _t17;
				void* _t20;
				CHAR* _t21;

				_t21 = _a4;
				_t20 = 0x64;
				while(1) {
					_t11 =  *0x4093ac; // 0x61736e
					_t20 = _t20 - 1;
					_a4 = _t11;
					_t12 = GetTickCount();
					_t17 = 0x1a;
					_a6 = _a6 + _t12 % _t17;
					_t15 = GetTempFileNameA(_a8,  &_a4, 0, _t21); // executed
					if(_t15 != 0) {
						break;
					}
					if(_t20 != 0) {
						continue;
					}
					 *_t21 =  *_t21 & 0x00000000;
					return _t15;
				}
				return _t21;
			}









                                                          0x0040599f
                                                          0x004059a5
                                                          0x004059a6
                                                          0x004059a6
                                                          0x004059ab
                                                          0x004059ac
                                                          0x004059af
                                                          0x004059b9
                                                          0x004059c6
                                                          0x004059c9
                                                          0x004059d1
                                                          0x00000000
                                                          0x00000000
                                                          0x004059d5
                                                          0x00000000
                                                          0x00000000
                                                          0x004059d7
                                                          0x00000000
                                                          0x004059d7
                                                          0x00000000

                                                          APIs
                                                          • GetTickCount.KERNEL32 ref: 004059AF
                                                          • GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 004059C9
                                                          Strings
                                                          • nsa, xrefs: 004059A6
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 0040599E
                                                          • "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe", xrefs: 0040599B
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: CountFileNameTempTick
                                                          • String ID: "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe"$C:\Users\user\AppData\Local\Temp\$nsa
                                                          • API String ID: 1716503409-2775345609
                                                          • Opcode ID: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
                                                          • Instruction ID: 3a3981258a6ccd3f3c7180c2fb01dffc681fdc90015df490a153c8b64b3610b8
                                                          • Opcode Fuzzy Hash: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
                                                          • Instruction Fuzzy Hash: 6DF08276708214ABEB108F55EC04B9B7B9CDF91760F10C03BFA48DA190D6B599548B99
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00402A7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 743 402a7a-402aa3 RegOpenKeyExA 744 402aa5-402ab0 743->744 745 402b0e-402b12 743->745 746 402acb-402adb RegEnumKeyA 744->746 747 402ab2-402ab5 746->747 748 402add-402aef RegCloseKey call 406092 746->748 750 402b02-402b05 RegCloseKey 747->750 751 402ab7-402ac9 call 402a7a 747->751 755 402af1-402b00 748->755 756 402b15-402b1b 748->756 753 402b0b-402b0d 750->753 751->746 751->748 753->745 755->745 756->753 758 402b1d-402b2b RegDeleteKeyA 756->758 758->753 760 402b2d 758->760 760->745
                                                          C-Code - Quality: 84%
                                                          			E00402A7A(void* _a4, char* _a8, intOrPtr _a12) {
				void* _v8;
				char _v272;
				long _t18;
				intOrPtr* _t27;
				long _t28;

				_t18 = RegOpenKeyExA(_a4, _a8, 0,  *0x4237b0 | 0x00000008,  &_v8); // executed
				if(_t18 == 0) {
					while(RegEnumKeyA(_v8, 0,  &_v272, 0x105) == 0) {
						if(_a12 != 0) {
							RegCloseKey(_v8);
							L8:
							return 1;
						}
						if(E00402A7A(_v8,  &_v272, 0) != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E00406092(3);
					if(_t27 == 0) {
						if( *0x4237b0 != 0) {
							goto L8;
						}
						_t28 = RegDeleteKeyA(_a4, _a8);
						if(_t28 != 0) {
							goto L8;
						}
						return _t28;
					}
					return  *_t27(_a4, _a8,  *0x4237b0, 0);
				}
				return _t18;
			}








                                                          0x00402a9b
                                                          0x00402aa3
                                                          0x00402acb
                                                          0x00402ab5
                                                          0x00402b05
                                                          0x00402b0b
                                                          0x00000000
                                                          0x00402b0d
                                                          0x00402ac9
                                                          0x00000000
                                                          0x00000000
                                                          0x00402ac9
                                                          0x00402ae0
                                                          0x00402ae8
                                                          0x00402aef
                                                          0x00402b1b
                                                          0x00000000
                                                          0x00000000
                                                          0x00402b23
                                                          0x00402b2b
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00402b2b
                                                          0x00000000
                                                          0x00402afe
                                                          0x00402b12

                                                          APIs
                                                          • RegOpenKeyExA.KERNELBASE(?,?,00000000,?,?), ref: 00402A9B
                                                          • RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AD7
                                                          • RegCloseKey.ADVAPI32(?), ref: 00402AE0
                                                          • RegCloseKey.ADVAPI32(?), ref: 00402B05
                                                          • RegDeleteKeyA.ADVAPI32(?,?), ref: 00402B23
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Close$DeleteEnumOpen
                                                          • String ID:
                                                          • API String ID: 1912718029-0
                                                          • Opcode ID: ae09a9da48d779165f4d820b178e7b78ee37b087aa05fe1e09047ef6d5127422
                                                          • Instruction ID: feb6aed171ad8b85e204e5b4e2feb4536d295dbd67c3687bd8867431d3a466b7
                                                          • Opcode Fuzzy Hash: ae09a9da48d779165f4d820b178e7b78ee37b087aa05fe1e09047ef6d5127422
                                                          • Instruction Fuzzy Hash: 53117F71A00108FFDF229F90DE89EAE3B7DEB54349B104076FA01B10A0D7749E51DB69
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 94%
                                                          			E100016BD(void* __edx, void* __edi, void* __esi, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void _v36;
				struct HINSTANCE__* _t34;
				intOrPtr _t38;
				void* _t44;
				void* _t45;
				void* _t46;
				void* _t50;
				intOrPtr _t53;
				signed int _t57;
				signed int _t61;
				void* _t65;
				void* _t66;
				void* _t70;
				void* _t74;

				_t74 = __esi;
				_t66 = __edi;
				_t65 = __edx;
				 *0x1000405c = _a8;
				 *0x10004060 = _a16;
				 *0x10004064 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x10004038, E10001556);
				_push(1); // executed
				_t34 = E10001A5D(); // executed
				_t50 = _t34;
				if(_t50 == 0) {
					L28:
					return _t34;
				} else {
					if( *((intOrPtr*)(_t50 + 4)) != 1) {
						E100021B0(_t50);
					}
					E100021FA(_t65, _t50);
					_t53 =  *((intOrPtr*)(_t50 + 4));
					if(_t53 == 0xffffffff) {
						L14:
						if(( *(_t50 + 0x810) & 0x00000004) == 0) {
							if( *((intOrPtr*)(_t50 + 4)) == 0) {
								_t34 = E100023DA(_t50);
							} else {
								_push(_t74);
								_push(_t66);
								_t12 = _t50 + 0x818; // 0x818
								_t57 = 8;
								memcpy( &_v36, _t12, _t57 << 2);
								_t38 = E10001559(_t50);
								_t15 = _t50 + 0x818; // 0x818
								_t70 = _t15;
								 *((intOrPtr*)(_t50 + 0x820)) = _t38;
								 *_t70 = 3;
								E100023DA(_t50);
								_t61 = 8;
								_t34 = memcpy(_t70,  &_v36, _t61 << 2);
							}
						} else {
							E100023DA(_t50);
							_t34 = GlobalFree(E10001266(E10001559(_t50)));
						}
						if( *((intOrPtr*)(_t50 + 4)) != 1) {
							_t34 = E100023A0(_t50);
							if(( *(_t50 + 0x810) & 0x00000040) != 0 &&  *_t50 == 1) {
								_t34 =  *(_t50 + 0x808);
								if(_t34 != 0) {
									_t34 = FreeLibrary(_t34);
								}
							}
							if(( *(_t50 + 0x810) & 0x00000020) != 0) {
								_t34 = E100014E2( *0x10004058);
							}
						}
						if(( *(_t50 + 0x810) & 0x00000002) != 0) {
							goto L28;
						} else {
							return GlobalFree(_t50);
						}
					}
					_t44 =  *_t50;
					if(_t44 == 0) {
						if(_t53 != 1) {
							goto L14;
						}
						E10002AA3(_t50);
						L12:
						_t50 = _t44;
						L13:
						goto L14;
					}
					_t45 = _t44 - 1;
					if(_t45 == 0) {
						L8:
						_t44 = E100027E8(_t53, _t50); // executed
						goto L12;
					}
					_t46 = _t45 - 1;
					if(_t46 == 0) {
						E10002589(_t50);
						goto L13;
					}
					if(_t46 != 1) {
						goto L14;
					}
					goto L8;
				}
			}

















                                                          0x100016bd
                                                          0x100016bd
                                                          0x100016bd
                                                          0x100016c7
                                                          0x100016cf
                                                          0x100016dc
                                                          0x100016ea
                                                          0x100016ed
                                                          0x100016ef
                                                          0x100016f4
                                                          0x100016f9
                                                          0x1000180c
                                                          0x1000180c
                                                          0x100016ff
                                                          0x10001703
                                                          0x10001706
                                                          0x1000170b
                                                          0x1000170d
                                                          0x10001713
                                                          0x10001719
                                                          0x10001749
                                                          0x10001750
                                                          0x10001774
                                                          0x100017b3
                                                          0x10001776
                                                          0x10001776
                                                          0x10001777
                                                          0x1000177a
                                                          0x10001780
                                                          0x10001784
                                                          0x10001787
                                                          0x1000178c
                                                          0x1000178c
                                                          0x10001793
                                                          0x10001799
                                                          0x1000179f
                                                          0x100017ab
                                                          0x100017ac
                                                          0x100017af
                                                          0x10001752
                                                          0x10001753
                                                          0x10001768
                                                          0x10001768
                                                          0x100017bd
                                                          0x100017c0
                                                          0x100017cd
                                                          0x100017d4
                                                          0x100017dc
                                                          0x100017df
                                                          0x100017df
                                                          0x100017dc
                                                          0x100017ec
                                                          0x100017f4
                                                          0x100017f9
                                                          0x100017ec
                                                          0x10001801
                                                          0x00000000
                                                          0x10001803
                                                          0x00000000
                                                          0x10001804
                                                          0x10001801
                                                          0x1000171d
                                                          0x10001720
                                                          0x1000173e
                                                          0x00000000
                                                          0x00000000
                                                          0x10001741
                                                          0x10001746
                                                          0x10001746
                                                          0x10001748
                                                          0x00000000
                                                          0x10001748
                                                          0x10001722
                                                          0x10001723
                                                          0x1000172b
                                                          0x1000172c
                                                          0x00000000
                                                          0x1000172c
                                                          0x10001725
                                                          0x10001726
                                                          0x10001734
                                                          0x00000000
                                                          0x10001734
                                                          0x10001729
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x10001729

                                                          APIs
                                                            • Part of subcall function 10001A5D: GlobalFree.KERNEL32 ref: 10001CC4
                                                            • Part of subcall function 10001A5D: GlobalFree.KERNEL32 ref: 10001CC9
                                                            • Part of subcall function 10001A5D: GlobalFree.KERNEL32 ref: 10001CCE
                                                          • GlobalFree.KERNEL32 ref: 10001768
                                                          • FreeLibrary.KERNEL32(?), ref: 100017DF
                                                          • GlobalFree.KERNEL32 ref: 10001804
                                                            • Part of subcall function 100021B0: GlobalAlloc.KERNEL32(00000040,7D8BEC45), ref: 100021E2
                                                            • Part of subcall function 10002589: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,10001739,00000000), ref: 100025FB
                                                            • Part of subcall function 10001559: lstrcpyA.KERNEL32(00000000,10004010,00000000,10001695,00000000), ref: 10001572
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.524434554.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.524374525.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          • Associated: 00000000.00000002.524488197.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          • Associated: 00000000.00000002.524503265.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Global$Free$Alloc$Librarylstrcpy
                                                          • String ID:
                                                          • API String ID: 1791698881-3916222277
                                                          • Opcode ID: 245ce87e028eba73b171f8f7f302eff0cc3bc38b2883f49ef8f533c6b67cfd43
                                                          • Instruction ID: 7bd52774c71d274dd6e07030a7ef65efb9a892d3f5f2eddd47f658e3267813e4
                                                          • Opcode Fuzzy Hash: 245ce87e028eba73b171f8f7f302eff0cc3bc38b2883f49ef8f533c6b67cfd43
                                                          • Instruction Fuzzy Hash: B5319C79408205DAFB41DF649CC5BCA37ECFF042D5F018465FA0A9A09EDF78A8858B60
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00401F90 Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 60%
                                                          			E00401F90(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t26;
				void* _t27;
				struct HINSTANCE__* _t30;
				CHAR* _t32;
				intOrPtr* _t33;
				void* _t34;

				_t27 = __ebx;
				asm("sbb eax, 0x4237b8");
				 *(_t34 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x423788 =  *0x423788 +  *(_t34 - 4);
					return 0;
				}
				_t32 = E00402A3A(0xfffffff0);
				 *(_t34 + 8) = E00402A3A(1);
				if( *((intOrPtr*)(_t34 - 0x18)) == __ebx) {
					L3:
					_t18 = LoadLibraryExA(_t32, _t27, 8); // executed
					_t30 = _t18;
					if(_t30 == _t27) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t33 = GetProcAddress(_t30,  *(_t34 + 8));
					if(_t33 == _t27) {
						E00404F12(0xfffffff7,  *(_t34 + 8));
					} else {
						 *(_t34 - 4) = _t27;
						if( *((intOrPtr*)(_t34 - 0x20)) == _t27) {
							 *_t33( *((intOrPtr*)(_t34 - 8)), 0x400, 0x424000, 0x40a7ec, 0x409000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t34 - 0x20)));
							if( *_t33() != 0) {
								 *(_t34 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t34 - 0x1c)) == _t27 && E00403619(_t30) != 0) {
						FreeLibrary(_t30); // executed
					}
					goto L16;
				}
				_t26 = GetModuleHandleA(_t32); // executed
				_t30 = _t26;
				if(_t30 != __ebx) {
					goto L4;
				}
				goto L3;
			}










                                                          0x00401f90
                                                          0x00401f90
                                                          0x00401f95
                                                          0x00401f9c
                                                          0x00402057
                                                          0x004021c4
                                                          0x004021c4
                                                          0x004028cf
                                                          0x004028d2
                                                          0x004028de
                                                          0x004028de
                                                          0x00401fab
                                                          0x00401fb5
                                                          0x00401fb8
                                                          0x00401fc7
                                                          0x00401fcb
                                                          0x00401fd1
                                                          0x00401fd5
                                                          0x00402050
                                                          0x00000000
                                                          0x00402050
                                                          0x00401fd7
                                                          0x00401fe0
                                                          0x00401fe4
                                                          0x00402028
                                                          0x00401fe6
                                                          0x00401fe9
                                                          0x00401fec
                                                          0x0040201c
                                                          0x00401fee
                                                          0x00401ff1
                                                          0x00401ffa
                                                          0x00401ffc
                                                          0x00401ffc
                                                          0x00401ffa
                                                          0x00401fec
                                                          0x00402030
                                                          0x00402045
                                                          0x00402045
                                                          0x00000000
                                                          0x00402030
                                                          0x00401fbb
                                                          0x00401fc1
                                                          0x00401fc5
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000

                                                          APIs
                                                          • GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00401FBB
                                                            • Part of subcall function 00404F12: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4B
                                                            • Part of subcall function 00404F12: lstrlenA.KERNEL32(00402FCF,Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5B
                                                            • Part of subcall function 00404F12: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,00402FCF,00402FCF,Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,00000000,0040E8C0,00000000), ref: 00404F6E
                                                            • Part of subcall function 00404F12: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll), ref: 00404F80
                                                            • Part of subcall function 00404F12: SendMessageA.USER32 ref: 00404FA6
                                                            • Part of subcall function 00404F12: SendMessageA.USER32 ref: 00404FC0
                                                            • Part of subcall function 00404F12: SendMessageA.USER32 ref: 00404FCE
                                                          • LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401FCB
                                                          • GetProcAddress.KERNEL32(00000000,?), ref: 00401FDB
                                                          • FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402045
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
                                                          • String ID:
                                                          • API String ID: 2987980305-0
                                                          • Opcode ID: ed5e7c77882740c65d017829f63facd0cb9ae9b8b33cb6e8c6aba375fa59f590
                                                          • Instruction ID: 033e4e5f5e4c037d50d2464c5542d6b5672e4837e9f8cb01fb8d89ff16108e1c
                                                          • Opcode Fuzzy Hash: ed5e7c77882740c65d017829f63facd0cb9ae9b8b33cb6e8c6aba375fa59f590
                                                          • Instruction Fuzzy Hash: 1A212B72904211FBDF217FA48E49AAE76B1AB45318F30423BF701B62D0C7BD49459A6E
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 004015B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 87%
                                                          			E004015B3(char __ebx) {
				void* _t13;
				int _t19;
				char _t21;
				void* _t22;
				char _t23;
				signed char _t24;
				char _t26;
				CHAR* _t28;
				char* _t32;
				void* _t33;

				_t26 = __ebx;
				_t28 = E00402A3A(0xfffffff0);
				_t13 = E00405804(_t28);
				_t30 = _t13;
				if(_t13 != __ebx) {
					do {
						_t32 = E00405796(_t30, 0x5c);
						_t21 =  *_t32;
						 *_t32 = _t26;
						 *((char*)(_t33 + 0xb)) = _t21;
						if(_t21 != _t26) {
							L5:
							_t22 = E00405455(_t28);
						} else {
							_t38 =  *((intOrPtr*)(_t33 - 0x20)) - _t26;
							if( *((intOrPtr*)(_t33 - 0x20)) == _t26 || E00405472(_t38) == 0) {
								goto L5;
							} else {
								_t22 = E004053D8(_t28); // executed
							}
						}
						if(_t22 != _t26) {
							if(_t22 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
							} else {
								_t24 = GetFileAttributesA(_t28); // executed
								if((_t24 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						_t23 =  *((intOrPtr*)(_t33 + 0xb));
						 *_t32 = _t23;
						_t30 = _t32 + 1;
					} while (_t23 != _t26);
				}
				if( *((intOrPtr*)(_t33 - 0x24)) == _t26) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00405CF9("C:\\Users\\hardz\\Pacifisterne\\Automatcafeer\\Syntaksgenkendelsernes\\Temposkifterne", _t28);
					_t19 = SetCurrentDirectoryA(_t28); // executed
					if(_t19 == 0) {
						 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
					}
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t33 - 4));
				return 0;
			}













                                                          0x004015b3
                                                          0x004015ba
                                                          0x004015bd
                                                          0x004015c2
                                                          0x004015c6
                                                          0x004015c8
                                                          0x004015d0
                                                          0x004015d2
                                                          0x004015d4
                                                          0x004015d8
                                                          0x004015db
                                                          0x004015f3
                                                          0x004015f4
                                                          0x004015dd
                                                          0x004015dd
                                                          0x004015e0
                                                          0x00000000
                                                          0x004015eb
                                                          0x004015ec
                                                          0x004015ec
                                                          0x004015e0
                                                          0x004015fb
                                                          0x00401602
                                                          0x0040160f
                                                          0x0040160f
                                                          0x00401604
                                                          0x00401605
                                                          0x0040160d
                                                          0x00000000
                                                          0x00000000
                                                          0x0040160d
                                                          0x00401602
                                                          0x00401612
                                                          0x00401615
                                                          0x00401617
                                                          0x00401618
                                                          0x004015c8
                                                          0x0040161f
                                                          0x0040164a
                                                          0x004021c4
                                                          0x00401621
                                                          0x00401623
                                                          0x0040162e
                                                          0x00401634
                                                          0x0040163c
                                                          0x00401642
                                                          0x00401642
                                                          0x0040163c
                                                          0x004028d2
                                                          0x004028de

                                                          APIs
                                                            • Part of subcall function 00405804: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,?,00405870,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,74D0FA90,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,74D0FA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405812
                                                            • Part of subcall function 00405804: CharNextA.USER32(00000000), ref: 00405817
                                                            • Part of subcall function 00405804: CharNextA.USER32(00000000), ref: 0040582B
                                                          • GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 00401605
                                                            • Part of subcall function 004053D8: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040541B
                                                          • SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne,00000000,00000000,000000F0), ref: 00401634
                                                          Strings
                                                          • C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne, xrefs: 00401629
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                          • String ID: C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne
                                                          • API String ID: 1892508949-1980816760
                                                          • Opcode ID: dc3f2b08dd0b23deb2200b8cff6eb9b6ab41173e829b03834ce904b4ad95c354
                                                          • Instruction ID: 4fb2b9239308f527e4829455642bf5c86be9504270dcf99fcce102751257b2ff
                                                          • Opcode Fuzzy Hash: dc3f2b08dd0b23deb2200b8cff6eb9b6ab41173e829b03834ce904b4ad95c354
                                                          • Instruction Fuzzy Hash: 1611E736508141ABEF217F650D415BF27B0EA92325738467FE592B62E2C63C4942A63F
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040548A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E0040548A(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x421510->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x421510,  &_v20); // executed
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}





                                                          0x00405493
                                                          0x004054b3
                                                          0x004054bb
                                                          0x004054c0
                                                          0x00000000
                                                          0x004054c6
                                                          0x004054ca

                                                          APIs
                                                          • CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421510,Error launching installer), ref: 004054B3
                                                          • CloseHandle.KERNEL32(?), ref: 004054C0
                                                          Strings
                                                          • Error launching installer, xrefs: 0040549D
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: CloseCreateHandleProcess
                                                          • String ID: Error launching installer
                                                          • API String ID: 3712363035-66219284
                                                          • Opcode ID: 8c32d595c10ae78cfc35805ab98709760fd6cf99201592758dbf5461ff55bb51
                                                          • Instruction ID: 90ee3f3d0c484d323fd0424032eb65db2415cafeee3384e03f1d9bc4b04e7a5d
                                                          • Opcode Fuzzy Hash: 8c32d595c10ae78cfc35805ab98709760fd6cf99201592758dbf5461ff55bb51
                                                          • Instruction Fuzzy Hash: FFE04FB4A002097FEB009B60EC05F7B7BBCEB00348F408561BD11F21A0E374A9508A78
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00406779 Relevance: 5.2, APIs: 4, Instructions: 236COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 99%
                                                          			E00406779() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M00406BE7))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4)); // executed
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8)); // executed
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}















                                                          0x00406779
                                                          0x00406779
                                                          0x00406779
                                                          0x00406779
                                                          0x0040677f
                                                          0x00406783
                                                          0x00406787
                                                          0x00406791
                                                          0x0040679f
                                                          0x00406a75
                                                          0x00406a75
                                                          0x00406a78
                                                          0x00406a7f
                                                          0x00406aac
                                                          0x00406aac
                                                          0x00406ab0
                                                          0x00000000
                                                          0x00000000
                                                          0x00406ab2
                                                          0x00406abb
                                                          0x00406ac1
                                                          0x00406ac4
                                                          0x00406ac7
                                                          0x00406aca
                                                          0x00406acd
                                                          0x00406ad3
                                                          0x00406aec
                                                          0x00406aef
                                                          0x00406afb
                                                          0x00406afc
                                                          0x00406aff
                                                          0x00406ad5
                                                          0x00406ad5
                                                          0x00406ae4
                                                          0x00406ae7
                                                          0x00406ae7
                                                          0x00406b09
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aac
                                                          0x00406ab0
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00406b0b
                                                          0x00406b0b
                                                          0x00406a84
                                                          0x00406a88
                                                          0x00406bc0
                                                          0x00406bc0
                                                          0x00406bca
                                                          0x00406bd2
                                                          0x00406bd9
                                                          0x00406bdb
                                                          0x00406be2
                                                          0x00406be6
                                                          0x00406be6
                                                          0x00406a8e
                                                          0x00406a94
                                                          0x00406a9b
                                                          0x00406aa3
                                                          0x00406aa3
                                                          0x00406aa6
                                                          0x00000000
                                                          0x00406aa6
                                                          0x00406b10
                                                          0x00406b1d
                                                          0x00406b20
                                                          0x00406a2c
                                                          0x00406a2c
                                                          0x00406a2c
                                                          0x004061c8
                                                          0x004061c8
                                                          0x004061c8
                                                          0x004061d1
                                                          0x00000000
                                                          0x00000000
                                                          0x004061d7
                                                          0x004061d7
                                                          0x00000000
                                                          0x004061de
                                                          0x004061e2
                                                          0x00000000
                                                          0x00000000
                                                          0x004061e8
                                                          0x004061eb
                                                          0x004061ee
                                                          0x004061f1
                                                          0x004061f5
                                                          0x00000000
                                                          0x00000000
                                                          0x004061fb
                                                          0x004061fb
                                                          0x004061fe
                                                          0x00406200
                                                          0x00406201
                                                          0x00406204
                                                          0x00406206
                                                          0x00406207
                                                          0x00406209
                                                          0x0040620c
                                                          0x00406211
                                                          0x00406216
                                                          0x0040621f
                                                          0x00406232
                                                          0x00406235
                                                          0x00406241
                                                          0x00406269
                                                          0x0040626b
                                                          0x00406279
                                                          0x00406279
                                                          0x0040627d
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040626d
                                                          0x0040626d
                                                          0x00406270
                                                          0x00406271
                                                          0x00406271
                                                          0x00000000
                                                          0x0040626d
                                                          0x00406243
                                                          0x00406247
                                                          0x0040624c
                                                          0x0040624c
                                                          0x00406255
                                                          0x0040625d
                                                          0x00406260
                                                          0x00000000
                                                          0x00406266
                                                          0x00406266
                                                          0x00000000
                                                          0x00406266
                                                          0x00000000
                                                          0x00406283
                                                          0x00406283
                                                          0x00406287
                                                          0x00406b33
                                                          0x00406b33
                                                          0x00000000
                                                          0x00406b33
                                                          0x0040628d
                                                          0x00406290
                                                          0x004062a0
                                                          0x004062a3
                                                          0x004062a6
                                                          0x004062a6
                                                          0x004062a6
                                                          0x004062a9
                                                          0x004062ad
                                                          0x00000000
                                                          0x00000000
                                                          0x004062af
                                                          0x004062af
                                                          0x004062b5
                                                          0x004062df
                                                          0x004062e5
                                                          0x004062ec
                                                          0x00000000
                                                          0x004062ec
                                                          0x004062b7
                                                          0x004062bb
                                                          0x004062be
                                                          0x004062c3
                                                          0x004062c3
                                                          0x004062ce
                                                          0x004062d6
                                                          0x004062d9
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040631e
                                                          0x00406324
                                                          0x00406327
                                                          0x00406334
                                                          0x0040633c
                                                          0x00000000
                                                          0x00000000
                                                          0x004062f3
                                                          0x004062f3
                                                          0x004062f7
                                                          0x00406b42
                                                          0x00406b42
                                                          0x00000000
                                                          0x00406b42
                                                          0x004062fd
                                                          0x00406303
                                                          0x0040630e
                                                          0x0040630e
                                                          0x0040630e
                                                          0x00406311
                                                          0x00406314
                                                          0x00406317
                                                          0x0040631c
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x004069b3
                                                          0x004069b3
                                                          0x004069b9
                                                          0x004069bf
                                                          0x004069c5
                                                          0x004069df
                                                          0x004069e2
                                                          0x004069e8
                                                          0x004069f3
                                                          0x004069f3
                                                          0x004069f5
                                                          0x004069c7
                                                          0x004069c7
                                                          0x004069d6
                                                          0x004069da
                                                          0x004069da
                                                          0x004069ff
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a01
                                                          0x00406a05
                                                          0x00406bb4
                                                          0x00406bb4
                                                          0x00000000
                                                          0x00406bb4
                                                          0x00406a0b
                                                          0x00406a11
                                                          0x00406a18
                                                          0x00406a20
                                                          0x00406a23
                                                          0x00406a26
                                                          0x00406a26
                                                          0x00406a2c
                                                          0x00406a2c
                                                          0x00000000
                                                          0x00000000
                                                          0x00406344
                                                          0x00406344
                                                          0x00406346
                                                          0x00406349
                                                          0x004063ba
                                                          0x004063ba
                                                          0x004063bd
                                                          0x004063c0
                                                          0x004063c7
                                                          0x004063d1
                                                          0x00000000
                                                          0x004063d1
                                                          0x0040634b
                                                          0x0040634b
                                                          0x0040634f
                                                          0x00406352
                                                          0x00406354
                                                          0x00406357
                                                          0x0040635a
                                                          0x0040635c
                                                          0x0040635f
                                                          0x00406361
                                                          0x00406366
                                                          0x00406369
                                                          0x0040636c
                                                          0x00406370
                                                          0x00406377
                                                          0x0040637a
                                                          0x00406381
                                                          0x00406385
                                                          0x0040638d
                                                          0x0040638d
                                                          0x0040638d
                                                          0x00406387
                                                          0x00406387
                                                          0x00406387
                                                          0x0040637c
                                                          0x0040637c
                                                          0x0040637c
                                                          0x00406391
                                                          0x00406394
                                                          0x004063b2
                                                          0x004063b2
                                                          0x004063b4
                                                          0x00000000
                                                          0x00406396
                                                          0x00406396
                                                          0x00406396
                                                          0x00406399
                                                          0x0040639c
                                                          0x0040639f
                                                          0x004063a1
                                                          0x004063a1
                                                          0x004063a1
                                                          0x004063a4
                                                          0x004063a7
                                                          0x004063a9
                                                          0x004063aa
                                                          0x004063ad
                                                          0x00000000
                                                          0x004063ad
                                                          0x00000000
                                                          0x004065e3
                                                          0x004065e3
                                                          0x004065e7
                                                          0x00406605
                                                          0x00406605
                                                          0x00406608
                                                          0x0040660f
                                                          0x00406612
                                                          0x00406615
                                                          0x00406618
                                                          0x0040661b
                                                          0x0040661e
                                                          0x00406620
                                                          0x00406627
                                                          0x00406628
                                                          0x0040662a
                                                          0x0040662d
                                                          0x00406630
                                                          0x00406633
                                                          0x00406633
                                                          0x00406638
                                                          0x00000000
                                                          0x00406638
                                                          0x004065e9
                                                          0x004065e9
                                                          0x004065ec
                                                          0x004065ef
                                                          0x004065f9
                                                          0x00000000
                                                          0x00000000
                                                          0x0040664d
                                                          0x0040664d
                                                          0x00406651
                                                          0x00406674
                                                          0x00406677
                                                          0x0040667a
                                                          0x00406684
                                                          0x00406653
                                                          0x00406653
                                                          0x00406656
                                                          0x00406659
                                                          0x0040665c
                                                          0x00406669
                                                          0x0040666c
                                                          0x0040666c
                                                          0x00000000
                                                          0x00000000
                                                          0x00406690
                                                          0x00406690
                                                          0x00406694
                                                          0x00000000
                                                          0x00000000
                                                          0x0040669a
                                                          0x0040669a
                                                          0x0040669e
                                                          0x00000000
                                                          0x00000000
                                                          0x004066a4
                                                          0x004066a4
                                                          0x004066a6
                                                          0x004066aa
                                                          0x004066aa
                                                          0x004066ad
                                                          0x004066b1
                                                          0x00000000
                                                          0x00000000
                                                          0x00406701
                                                          0x00406701
                                                          0x00406705
                                                          0x0040670c
                                                          0x0040670c
                                                          0x0040670f
                                                          0x00406712
                                                          0x0040671c
                                                          0x00000000
                                                          0x0040671c
                                                          0x00406707
                                                          0x00406707
                                                          0x00000000
                                                          0x00000000
                                                          0x00406728
                                                          0x00406728
                                                          0x0040672c
                                                          0x00406733
                                                          0x00406736
                                                          0x00406739
                                                          0x0040672e
                                                          0x0040672e
                                                          0x0040672e
                                                          0x0040673c
                                                          0x0040673f
                                                          0x00406742
                                                          0x00406742
                                                          0x00406745
                                                          0x00406748
                                                          0x0040674b
                                                          0x0040674b
                                                          0x0040674e
                                                          0x00406755
                                                          0x0040675a
                                                          0x00000000
                                                          0x00000000
                                                          0x004067e8
                                                          0x004067e8
                                                          0x004067ec
                                                          0x00406b8a
                                                          0x00406b8a
                                                          0x00000000
                                                          0x00406b8a
                                                          0x004067f2
                                                          0x004067f2
                                                          0x004067f5
                                                          0x004067f8
                                                          0x004067fc
                                                          0x004067ff
                                                          0x00406805
                                                          0x00406807
                                                          0x00406807
                                                          0x00406807
                                                          0x0040680a
                                                          0x0040680d
                                                          0x00000000
                                                          0x00000000
                                                          0x004063dd
                                                          0x004063dd
                                                          0x004063e1
                                                          0x00406b4e
                                                          0x00406b4e
                                                          0x00000000
                                                          0x00406b4e
                                                          0x004063e7
                                                          0x004063e7
                                                          0x004063ea
                                                          0x004063ed
                                                          0x004063f1
                                                          0x004063f4
                                                          0x004063fa
                                                          0x004063fc
                                                          0x004063fc
                                                          0x004063fc
                                                          0x004063ff
                                                          0x00406402
                                                          0x00406402
                                                          0x00406405
                                                          0x00406408
                                                          0x00000000
                                                          0x00000000
                                                          0x0040640e
                                                          0x0040640e
                                                          0x00406414
                                                          0x00000000
                                                          0x00000000
                                                          0x0040641a
                                                          0x0040641a
                                                          0x0040641e
                                                          0x00406421
                                                          0x00406424
                                                          0x00406427
                                                          0x0040642a
                                                          0x0040642b
                                                          0x0040642e
                                                          0x00406430
                                                          0x00406436
                                                          0x00406439
                                                          0x0040643c
                                                          0x0040643f
                                                          0x00406442
                                                          0x00406445
                                                          0x00406448
                                                          0x00406464
                                                          0x00406467
                                                          0x0040646a
                                                          0x0040646d
                                                          0x00406474
                                                          0x00406478
                                                          0x0040647a
                                                          0x0040647e
                                                          0x0040644a
                                                          0x0040644a
                                                          0x0040644e
                                                          0x00406456
                                                          0x0040645b
                                                          0x0040645d
                                                          0x0040645f
                                                          0x0040645f
                                                          0x00406481
                                                          0x00406488
                                                          0x0040648b
                                                          0x00000000
                                                          0x00406491
                                                          0x00406491
                                                          0x00000000
                                                          0x00406491
                                                          0x00000000
                                                          0x00406496
                                                          0x00406496
                                                          0x0040649a
                                                          0x00406b5a
                                                          0x00406b5a
                                                          0x00000000
                                                          0x00406b5a
                                                          0x004064a0
                                                          0x004064a0
                                                          0x004064a3
                                                          0x004064a6
                                                          0x004064aa
                                                          0x004064ad
                                                          0x004064b3
                                                          0x004064b5
                                                          0x004064b5
                                                          0x004064b5
                                                          0x004064b8
                                                          0x004064bb
                                                          0x004064bb
                                                          0x004064bb
                                                          0x004064c1
                                                          0x00000000
                                                          0x00000000
                                                          0x004064c3
                                                          0x004064c3
                                                          0x004064c6
                                                          0x004064c9
                                                          0x004064cc
                                                          0x004064cf
                                                          0x004064d2
                                                          0x004064d5
                                                          0x004064d8
                                                          0x004064db
                                                          0x004064de
                                                          0x004064e1
                                                          0x004064f9
                                                          0x004064fc
                                                          0x004064ff
                                                          0x00406502
                                                          0x00406502
                                                          0x00406505
                                                          0x00406509
                                                          0x0040650b
                                                          0x004064e3
                                                          0x004064e3
                                                          0x004064eb
                                                          0x004064f0
                                                          0x004064f2
                                                          0x004064f4
                                                          0x004064f4
                                                          0x0040650e
                                                          0x00406515
                                                          0x00406518
                                                          0x00000000
                                                          0x0040651a
                                                          0x0040651a
                                                          0x00000000
                                                          0x0040651a
                                                          0x00406518
                                                          0x0040651f
                                                          0x0040651f
                                                          0x0040651f
                                                          0x0040651f
                                                          0x00000000
                                                          0x00000000
                                                          0x0040655a
                                                          0x0040655a
                                                          0x0040655e
                                                          0x00406b66
                                                          0x00406b66
                                                          0x00000000
                                                          0x00406b66
                                                          0x00406564
                                                          0x00406564
                                                          0x00406567
                                                          0x0040656a
                                                          0x0040656e
                                                          0x00406571
                                                          0x00406577
                                                          0x00406579
                                                          0x00406579
                                                          0x00406579
                                                          0x0040657c
                                                          0x0040657f
                                                          0x0040657f
                                                          0x00406585
                                                          0x00406523
                                                          0x00406523
                                                          0x00406526
                                                          0x00000000
                                                          0x00406526
                                                          0x00406587
                                                          0x00406587
                                                          0x0040658a
                                                          0x0040658d
                                                          0x00406590
                                                          0x00406593
                                                          0x00406596
                                                          0x00406599
                                                          0x0040659c
                                                          0x0040659f
                                                          0x004065a2
                                                          0x004065a5
                                                          0x004065bd
                                                          0x004065c0
                                                          0x004065c3
                                                          0x004065c6
                                                          0x004065c6
                                                          0x004065c9
                                                          0x004065cd
                                                          0x004065cf
                                                          0x004065a7
                                                          0x004065a7
                                                          0x004065af
                                                          0x004065b4
                                                          0x004065b6
                                                          0x004065b8
                                                          0x004065b8
                                                          0x004065d2
                                                          0x004065d9
                                                          0x004065dc
                                                          0x00000000
                                                          0x004065de
                                                          0x004065de
                                                          0x00000000
                                                          0x004065de
                                                          0x00000000
                                                          0x0040686b
                                                          0x0040686b
                                                          0x0040686f
                                                          0x00406b96
                                                          0x00406b96
                                                          0x00000000
                                                          0x00406b96
                                                          0x00406875
                                                          0x00406875
                                                          0x00406878
                                                          0x0040687b
                                                          0x0040687f
                                                          0x00406882
                                                          0x00406888
                                                          0x0040688a
                                                          0x0040688a
                                                          0x0040688a
                                                          0x0040688d
                                                          0x00000000
                                                          0x00000000
                                                          0x0040663b
                                                          0x0040663b
                                                          0x0040663e
                                                          0x00000000
                                                          0x00000000
                                                          0x0040697a
                                                          0x0040697a
                                                          0x0040697e
                                                          0x004069a0
                                                          0x004069a0
                                                          0x004069a3
                                                          0x004069ad
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00000000
                                                          0x004069b0
                                                          0x00406980
                                                          0x00406980
                                                          0x00406983
                                                          0x00406987
                                                          0x0040698a
                                                          0x0040698a
                                                          0x0040698d
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a37
                                                          0x00406a37
                                                          0x00406a3b
                                                          0x00406a59
                                                          0x00406a59
                                                          0x00406a59
                                                          0x00406a59
                                                          0x00406a60
                                                          0x00406a67
                                                          0x00406a6e
                                                          0x00406a6e
                                                          0x00406a75
                                                          0x00406a78
                                                          0x00406a7f
                                                          0x00000000
                                                          0x00406a82
                                                          0x00406a3d
                                                          0x00406a3d
                                                          0x00406a40
                                                          0x00406a43
                                                          0x00406a46
                                                          0x00406a4d
                                                          0x00406991
                                                          0x00406991
                                                          0x00406994
                                                          0x00000000
                                                          0x00000000
                                                          0x00406b28
                                                          0x00406b28
                                                          0x00406b2b
                                                          0x00406a2c
                                                          0x00406a2c
                                                          0x00406a2c
                                                          0x00000000
                                                          0x00406a32
                                                          0x00000000
                                                          0x00406762
                                                          0x00406762
                                                          0x00406764
                                                          0x0040676b
                                                          0x0040676c
                                                          0x0040676e
                                                          0x00406771
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a75
                                                          0x00406a75
                                                          0x00406a78
                                                          0x00406a7f
                                                          0x00000000
                                                          0x00406a82
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x004067a7
                                                          0x004067a7
                                                          0x004067aa
                                                          0x004067e0
                                                          0x004067e0
                                                          0x00406910
                                                          0x00406910
                                                          0x00406910
                                                          0x00406910
                                                          0x00406913
                                                          0x00406913
                                                          0x00406916
                                                          0x00406918
                                                          0x00406ba2
                                                          0x00406ba2
                                                          0x00000000
                                                          0x00406ba2
                                                          0x0040691e
                                                          0x0040691e
                                                          0x00406921
                                                          0x00000000
                                                          0x00000000
                                                          0x00406927
                                                          0x00406927
                                                          0x0040692b
                                                          0x0040692e
                                                          0x0040692e
                                                          0x0040692e
                                                          0x00000000
                                                          0x0040692e
                                                          0x004067ac
                                                          0x004067ac
                                                          0x004067ae
                                                          0x004067b0
                                                          0x004067b2
                                                          0x004067b5
                                                          0x004067b6
                                                          0x004067b8
                                                          0x004067ba
                                                          0x004067bd
                                                          0x004067c0
                                                          0x004067d6
                                                          0x004067d6
                                                          0x004067db
                                                          0x00406813
                                                          0x00406813
                                                          0x00406817
                                                          0x00406840
                                                          0x00406843
                                                          0x00406845
                                                          0x0040684c
                                                          0x0040684f
                                                          0x00406852
                                                          0x00406852
                                                          0x00406857
                                                          0x00406857
                                                          0x00406859
                                                          0x0040685c
                                                          0x00406863
                                                          0x00406866
                                                          0x00406893
                                                          0x00406893
                                                          0x00406896
                                                          0x00406899
                                                          0x0040690d
                                                          0x0040690d
                                                          0x0040690d
                                                          0x0040690d
                                                          0x00000000
                                                          0x0040690d
                                                          0x0040689b
                                                          0x0040689b
                                                          0x004068a1
                                                          0x004068a4
                                                          0x004068a7
                                                          0x004068aa
                                                          0x004068ad
                                                          0x004068b0
                                                          0x004068b3
                                                          0x004068b6
                                                          0x004068b9
                                                          0x004068bc
                                                          0x004068d5
                                                          0x004068d7
                                                          0x004068da
                                                          0x004068db
                                                          0x004068de
                                                          0x004068e0
                                                          0x004068e3
                                                          0x004068e5
                                                          0x004068e7
                                                          0x004068ea
                                                          0x004068ec
                                                          0x004068ef
                                                          0x004068f3
                                                          0x004068f5
                                                          0x004068f5
                                                          0x004068f6
                                                          0x004068f9
                                                          0x004068fc
                                                          0x004068be
                                                          0x004068be
                                                          0x004068c6
                                                          0x004068cb
                                                          0x004068cd
                                                          0x004068d0
                                                          0x004068d0
                                                          0x004068ff
                                                          0x00406906
                                                          0x00406890
                                                          0x00406890
                                                          0x00406890
                                                          0x00406890
                                                          0x00000000
                                                          0x00406908
                                                          0x00406908
                                                          0x00000000
                                                          0x00406908
                                                          0x00406906
                                                          0x00406819
                                                          0x00406819
                                                          0x0040681c
                                                          0x0040681e
                                                          0x00406821
                                                          0x00406824
                                                          0x00406827
                                                          0x00406829
                                                          0x0040682c
                                                          0x0040682f
                                                          0x0040682f
                                                          0x00406832
                                                          0x00406832
                                                          0x00406835
                                                          0x0040683c
                                                          0x00406810
                                                          0x00406810
                                                          0x00406810
                                                          0x00406810
                                                          0x00000000
                                                          0x0040683e
                                                          0x0040683e
                                                          0x00000000
                                                          0x0040683e
                                                          0x0040683c
                                                          0x004067c2
                                                          0x004067c2
                                                          0x004067c5
                                                          0x004067c7
                                                          0x004067ca
                                                          0x00000000
                                                          0x00000000
                                                          0x00406529
                                                          0x00406529
                                                          0x0040652d
                                                          0x00406b72
                                                          0x00406b72
                                                          0x00000000
                                                          0x00406b72
                                                          0x00406533
                                                          0x00406533
                                                          0x00406536
                                                          0x00406539
                                                          0x0040653c
                                                          0x0040653f
                                                          0x00406542
                                                          0x00406545
                                                          0x00406547
                                                          0x0040654a
                                                          0x0040654d
                                                          0x00406550
                                                          0x00406552
                                                          0x00406552
                                                          0x00406552
                                                          0x00000000
                                                          0x00000000
                                                          0x004066b4
                                                          0x004066b4
                                                          0x004066b8
                                                          0x00406b7e
                                                          0x00406b7e
                                                          0x00000000
                                                          0x00406b7e
                                                          0x004066be
                                                          0x004066be
                                                          0x004066c1
                                                          0x004066c4
                                                          0x004066c7
                                                          0x004066c9
                                                          0x004066c9
                                                          0x004066c9
                                                          0x004066cc
                                                          0x004066cf
                                                          0x004066d2
                                                          0x004066d5
                                                          0x004066d8
                                                          0x004066db
                                                          0x004066dc
                                                          0x004066de
                                                          0x004066de
                                                          0x004066de
                                                          0x004066e1
                                                          0x004066e4
                                                          0x004066e7
                                                          0x004066ea
                                                          0x004066ea
                                                          0x004066ea
                                                          0x004066ed
                                                          0x004066ef
                                                          0x004066ef
                                                          0x00000000
                                                          0x00000000
                                                          0x00406931
                                                          0x00406931
                                                          0x00406931
                                                          0x00406935
                                                          0x00000000
                                                          0x00000000
                                                          0x0040693b
                                                          0x0040693b
                                                          0x0040693e
                                                          0x00406941
                                                          0x00406944
                                                          0x00406946
                                                          0x00406946
                                                          0x00406946
                                                          0x00406949
                                                          0x0040694c
                                                          0x0040694f
                                                          0x00406952
                                                          0x00406955
                                                          0x00406958
                                                          0x00406959
                                                          0x0040695b
                                                          0x0040695b
                                                          0x0040695b
                                                          0x0040695e
                                                          0x00406961
                                                          0x00406964
                                                          0x00406967
                                                          0x0040696a
                                                          0x0040696e
                                                          0x00406970
                                                          0x00406973
                                                          0x00000000
                                                          0x00406975
                                                          0x00406975
                                                          0x004066f2
                                                          0x004066f2
                                                          0x00000000
                                                          0x004066f2
                                                          0x00406973
                                                          0x00406ba8
                                                          0x00406ba8
                                                          0x00000000
                                                          0x00000000
                                                          0x004061d7
                                                          0x00406bdf
                                                          0x00406bdf
                                                          0x00000000
                                                          0x00406bdf
                                                          0x00406a2c
                                                          0x00406aac
                                                          0x00406a75

                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b4bbaf917c5b2b4b29eca7dd879fe0279583c9caa0a8680a3fb668f2eecfa979
                                                          • Instruction ID: ac331763182a67db8ffe8b732b67c8974d54266b30473341b06133cd37c0d4bc
                                                          • Opcode Fuzzy Hash: b4bbaf917c5b2b4b29eca7dd879fe0279583c9caa0a8680a3fb668f2eecfa979
                                                          • Instruction Fuzzy Hash: ECA13171E00229CBDF28DFA8C8547ADBBB1FB44305F11816ED816BB281C7786A96CF44
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040697A Relevance: 5.2, APIs: 4, Instructions: 208COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 98%
                                                          			E0040697A() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00406BE7))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4)); // executed
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}








                                                          0x00000000
                                                          0x0040697a
                                                          0x0040697a
                                                          0x0040697e
                                                          0x004069a3
                                                          0x004069ad
                                                          0x00000000
                                                          0x00406980
                                                          0x00406980
                                                          0x00406983
                                                          0x00406987
                                                          0x0040698a
                                                          0x0040698d
                                                          0x00406991
                                                          0x00406991
                                                          0x00406994
                                                          0x00406a6e
                                                          0x00406a6e
                                                          0x00406a75
                                                          0x00406a75
                                                          0x00406a78
                                                          0x00406a7f
                                                          0x00406aac
                                                          0x00406ab0
                                                          0x00406b10
                                                          0x00406b13
                                                          0x00406b18
                                                          0x00406b19
                                                          0x00406b1b
                                                          0x00406b1d
                                                          0x00406b20
                                                          0x00406a2c
                                                          0x00406a2c
                                                          0x00406a2c
                                                          0x004061c8
                                                          0x004061c8
                                                          0x004061c8
                                                          0x004061d1
                                                          0x00000000
                                                          0x00000000
                                                          0x004061d7
                                                          0x00000000
                                                          0x004061e2
                                                          0x00000000
                                                          0x00000000
                                                          0x004061eb
                                                          0x004061ee
                                                          0x004061f1
                                                          0x004061f5
                                                          0x00000000
                                                          0x00000000
                                                          0x004061fb
                                                          0x004061fe
                                                          0x00406200
                                                          0x00406201
                                                          0x00406204
                                                          0x00406206
                                                          0x00406207
                                                          0x00406209
                                                          0x0040620c
                                                          0x00406211
                                                          0x00406216
                                                          0x0040621f
                                                          0x00406232
                                                          0x00406235
                                                          0x00406241
                                                          0x00406269
                                                          0x0040626b
                                                          0x00406279
                                                          0x00406279
                                                          0x0040627d
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040626d
                                                          0x0040626d
                                                          0x00406270
                                                          0x00406271
                                                          0x00406271
                                                          0x00000000
                                                          0x0040626d
                                                          0x00406247
                                                          0x0040624c
                                                          0x0040624c
                                                          0x00406255
                                                          0x0040625d
                                                          0x00406260
                                                          0x00000000
                                                          0x00406266
                                                          0x00406266
                                                          0x00000000
                                                          0x00406266
                                                          0x00000000
                                                          0x00406283
                                                          0x00406283
                                                          0x00406287
                                                          0x00406b33
                                                          0x00000000
                                                          0x00406b33
                                                          0x00406290
                                                          0x004062a0
                                                          0x004062a3
                                                          0x004062a6
                                                          0x004062a6
                                                          0x004062a6
                                                          0x004062a9
                                                          0x004062ad
                                                          0x00000000
                                                          0x00000000
                                                          0x004062af
                                                          0x004062b5
                                                          0x004062df
                                                          0x004062e5
                                                          0x004062ec
                                                          0x00000000
                                                          0x004062ec
                                                          0x004062bb
                                                          0x004062be
                                                          0x004062c3
                                                          0x004062c3
                                                          0x004062ce
                                                          0x004062d6
                                                          0x004062d9
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040631e
                                                          0x00406324
                                                          0x00406327
                                                          0x00406334
                                                          0x0040633c
                                                          0x00000000
                                                          0x00000000
                                                          0x004062f3
                                                          0x004062f3
                                                          0x004062f7
                                                          0x00406b42
                                                          0x00000000
                                                          0x00406b42
                                                          0x00406303
                                                          0x0040630e
                                                          0x0040630e
                                                          0x0040630e
                                                          0x00406311
                                                          0x00406314
                                                          0x00406317
                                                          0x0040631c
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x004069b3
                                                          0x004069b3
                                                          0x004069b9
                                                          0x004069bf
                                                          0x004069c5
                                                          0x004069df
                                                          0x004069e2
                                                          0x004069e8
                                                          0x004069f3
                                                          0x004069f3
                                                          0x004069f5
                                                          0x004069c7
                                                          0x004069c7
                                                          0x004069d6
                                                          0x004069da
                                                          0x004069da
                                                          0x004069ff
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a01
                                                          0x00406a05
                                                          0x00406bb4
                                                          0x00000000
                                                          0x00406bb4
                                                          0x00406a11
                                                          0x00406a18
                                                          0x00406a20
                                                          0x00406a23
                                                          0x00406a26
                                                          0x00406a26
                                                          0x00000000
                                                          0x00000000
                                                          0x00406344
                                                          0x00406346
                                                          0x00406349
                                                          0x004063ba
                                                          0x004063bd
                                                          0x004063c0
                                                          0x004063c7
                                                          0x004063d1
                                                          0x00000000
                                                          0x004063d1
                                                          0x0040634b
                                                          0x0040634f
                                                          0x00406352
                                                          0x00406354
                                                          0x00406357
                                                          0x0040635a
                                                          0x0040635c
                                                          0x0040635f
                                                          0x00406361
                                                          0x00406366
                                                          0x00406369
                                                          0x0040636c
                                                          0x00406370
                                                          0x00406377
                                                          0x0040637a
                                                          0x00406381
                                                          0x00406385
                                                          0x0040638d
                                                          0x0040638d
                                                          0x0040638d
                                                          0x00406387
                                                          0x00406387
                                                          0x00406387
                                                          0x0040637c
                                                          0x0040637c
                                                          0x0040637c
                                                          0x00406391
                                                          0x00406394
                                                          0x004063b2
                                                          0x004063b4
                                                          0x00000000
                                                          0x00406396
                                                          0x00406396
                                                          0x00406399
                                                          0x0040639c
                                                          0x0040639f
                                                          0x004063a1
                                                          0x004063a1
                                                          0x004063a1
                                                          0x004063a4
                                                          0x004063a7
                                                          0x004063a9
                                                          0x004063aa
                                                          0x004063ad
                                                          0x00000000
                                                          0x004063ad
                                                          0x00000000
                                                          0x004065e3
                                                          0x004065e7
                                                          0x00406605
                                                          0x00406608
                                                          0x0040660f
                                                          0x00406612
                                                          0x00406615
                                                          0x00406618
                                                          0x0040661b
                                                          0x0040661e
                                                          0x00406620
                                                          0x00406627
                                                          0x00406628
                                                          0x0040662a
                                                          0x0040662d
                                                          0x00406630
                                                          0x00406633
                                                          0x00406633
                                                          0x00406638
                                                          0x00000000
                                                          0x00406638
                                                          0x004065e9
                                                          0x004065ec
                                                          0x004065ef
                                                          0x004065f9
                                                          0x00000000
                                                          0x00000000
                                                          0x0040664d
                                                          0x00406651
                                                          0x00406674
                                                          0x00406677
                                                          0x0040667a
                                                          0x00406684
                                                          0x00406653
                                                          0x00406653
                                                          0x00406656
                                                          0x00406659
                                                          0x0040665c
                                                          0x00406669
                                                          0x0040666c
                                                          0x0040666c
                                                          0x00000000
                                                          0x00000000
                                                          0x00406690
                                                          0x00406694
                                                          0x00000000
                                                          0x00000000
                                                          0x0040669a
                                                          0x0040669e
                                                          0x00000000
                                                          0x00000000
                                                          0x004066a4
                                                          0x004066a6
                                                          0x004066aa
                                                          0x004066aa
                                                          0x004066ad
                                                          0x004066b1
                                                          0x00000000
                                                          0x00000000
                                                          0x00406701
                                                          0x00406705
                                                          0x0040670c
                                                          0x0040670f
                                                          0x00406712
                                                          0x0040671c
                                                          0x00000000
                                                          0x0040671c
                                                          0x00406707
                                                          0x00000000
                                                          0x00000000
                                                          0x00406728
                                                          0x0040672c
                                                          0x00406733
                                                          0x00406736
                                                          0x00406739
                                                          0x0040672e
                                                          0x0040672e
                                                          0x0040672e
                                                          0x0040673c
                                                          0x0040673f
                                                          0x00406742
                                                          0x00406742
                                                          0x00406745
                                                          0x00406748
                                                          0x0040674b
                                                          0x0040674b
                                                          0x0040674e
                                                          0x00406755
                                                          0x0040675a
                                                          0x00000000
                                                          0x00000000
                                                          0x004067e8
                                                          0x004067e8
                                                          0x004067ec
                                                          0x00406b8a
                                                          0x00000000
                                                          0x00406b8a
                                                          0x004067f2
                                                          0x004067f5
                                                          0x004067f8
                                                          0x004067fc
                                                          0x004067ff
                                                          0x00406805
                                                          0x00406807
                                                          0x00406807
                                                          0x00406807
                                                          0x0040680a
                                                          0x0040680d
                                                          0x00000000
                                                          0x00000000
                                                          0x004063dd
                                                          0x004063dd
                                                          0x004063e1
                                                          0x00406b4e
                                                          0x00000000
                                                          0x00406b4e
                                                          0x004063e7
                                                          0x004063ea
                                                          0x004063ed
                                                          0x004063f1
                                                          0x004063f4
                                                          0x004063fa
                                                          0x004063fc
                                                          0x004063fc
                                                          0x004063fc
                                                          0x004063ff
                                                          0x00406402
                                                          0x00406402
                                                          0x00406405
                                                          0x00406408
                                                          0x00000000
                                                          0x00000000
                                                          0x0040640e
                                                          0x00406414
                                                          0x00000000
                                                          0x00000000
                                                          0x0040641a
                                                          0x0040641a
                                                          0x0040641e
                                                          0x00406421
                                                          0x00406424
                                                          0x00406427
                                                          0x0040642a
                                                          0x0040642b
                                                          0x0040642e
                                                          0x00406430
                                                          0x00406436
                                                          0x00406439
                                                          0x0040643c
                                                          0x0040643f
                                                          0x00406442
                                                          0x00406445
                                                          0x00406448
                                                          0x00406464
                                                          0x00406467
                                                          0x0040646a
                                                          0x0040646d
                                                          0x00406474
                                                          0x00406478
                                                          0x0040647a
                                                          0x0040647e
                                                          0x0040644a
                                                          0x0040644a
                                                          0x0040644e
                                                          0x00406456
                                                          0x0040645b
                                                          0x0040645d
                                                          0x0040645f
                                                          0x0040645f
                                                          0x00406481
                                                          0x00406488
                                                          0x0040648b
                                                          0x00000000
                                                          0x00406491
                                                          0x00000000
                                                          0x00406491
                                                          0x00000000
                                                          0x00406496
                                                          0x00406496
                                                          0x0040649a
                                                          0x00406b5a
                                                          0x00000000
                                                          0x00406b5a
                                                          0x004064a0
                                                          0x004064a3
                                                          0x004064a6
                                                          0x004064aa
                                                          0x004064ad
                                                          0x004064b3
                                                          0x004064b5
                                                          0x004064b5
                                                          0x004064b5
                                                          0x004064b8
                                                          0x004064bb
                                                          0x004064bb
                                                          0x004064bb
                                                          0x004064c1
                                                          0x00000000
                                                          0x00000000
                                                          0x004064c3
                                                          0x004064c6
                                                          0x004064c9
                                                          0x004064cc
                                                          0x004064cf
                                                          0x004064d2
                                                          0x004064d5
                                                          0x004064d8
                                                          0x004064db
                                                          0x004064de
                                                          0x004064e1
                                                          0x004064f9
                                                          0x004064fc
                                                          0x004064ff
                                                          0x00406502
                                                          0x00406502
                                                          0x00406505
                                                          0x00406509
                                                          0x0040650b
                                                          0x004064e3
                                                          0x004064e3
                                                          0x004064eb
                                                          0x004064f0
                                                          0x004064f2
                                                          0x004064f4
                                                          0x004064f4
                                                          0x0040650e
                                                          0x00406515
                                                          0x00406518
                                                          0x00000000
                                                          0x0040651a
                                                          0x00000000
                                                          0x0040651a
                                                          0x00406518
                                                          0x0040651f
                                                          0x0040651f
                                                          0x0040651f
                                                          0x0040651f
                                                          0x00000000
                                                          0x00000000
                                                          0x0040655a
                                                          0x0040655a
                                                          0x0040655e
                                                          0x00406b66
                                                          0x00000000
                                                          0x00406b66
                                                          0x00406564
                                                          0x00406567
                                                          0x0040656a
                                                          0x0040656e
                                                          0x00406571
                                                          0x00406577
                                                          0x00406579
                                                          0x00406579
                                                          0x00406579
                                                          0x0040657c
                                                          0x0040657f
                                                          0x0040657f
                                                          0x00406585
                                                          0x00406523
                                                          0x00406523
                                                          0x00406526
                                                          0x00000000
                                                          0x00406526
                                                          0x00406587
                                                          0x00406587
                                                          0x0040658a
                                                          0x0040658d
                                                          0x00406590
                                                          0x00406593
                                                          0x00406596
                                                          0x00406599
                                                          0x0040659c
                                                          0x0040659f
                                                          0x004065a2
                                                          0x004065a5
                                                          0x004065bd
                                                          0x004065c0
                                                          0x004065c3
                                                          0x004065c6
                                                          0x004065c6
                                                          0x004065c9
                                                          0x004065cd
                                                          0x004065cf
                                                          0x004065a7
                                                          0x004065a7
                                                          0x004065af
                                                          0x004065b4
                                                          0x004065b6
                                                          0x004065b8
                                                          0x004065b8
                                                          0x004065d2
                                                          0x004065d9
                                                          0x004065dc
                                                          0x00000000
                                                          0x004065de
                                                          0x00000000
                                                          0x004065de
                                                          0x00000000
                                                          0x0040686b
                                                          0x0040686b
                                                          0x0040686f
                                                          0x00406b96
                                                          0x00000000
                                                          0x00406b96
                                                          0x00406875
                                                          0x00406878
                                                          0x0040687b
                                                          0x0040687f
                                                          0x00406882
                                                          0x00406888
                                                          0x0040688a
                                                          0x0040688a
                                                          0x0040688a
                                                          0x0040688d
                                                          0x00000000
                                                          0x00000000
                                                          0x0040663b
                                                          0x0040663b
                                                          0x0040663e
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a37
                                                          0x00406a3b
                                                          0x00406a59
                                                          0x00406a59
                                                          0x00406a59
                                                          0x00406a60
                                                          0x00406a67
                                                          0x00000000
                                                          0x00406a67
                                                          0x00406a3d
                                                          0x00406a40
                                                          0x00406a43
                                                          0x00406a46
                                                          0x00406a4d
                                                          0x00000000
                                                          0x00000000
                                                          0x00406b28
                                                          0x00406b2b
                                                          0x00406a2c
                                                          0x00406a2c
                                                          0x00000000
                                                          0x00000000
                                                          0x00406762
                                                          0x00406764
                                                          0x0040676b
                                                          0x0040676c
                                                          0x0040676e
                                                          0x00406771
                                                          0x00000000
                                                          0x00000000
                                                          0x00406779
                                                          0x0040677c
                                                          0x0040677f
                                                          0x00406781
                                                          0x00406783
                                                          0x00406783
                                                          0x00406784
                                                          0x00406787
                                                          0x0040678e
                                                          0x00406791
                                                          0x0040679f
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a84
                                                          0x00406a84
                                                          0x00406a88
                                                          0x00406bc0
                                                          0x00000000
                                                          0x00406bc0
                                                          0x00406a8e
                                                          0x00406a91
                                                          0x00406a94
                                                          0x00406a98
                                                          0x00406a9b
                                                          0x00406aa1
                                                          0x00406aa3
                                                          0x00406aa3
                                                          0x00406aa3
                                                          0x00406aa6
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00000000
                                                          0x00000000
                                                          0x004067a7
                                                          0x004067aa
                                                          0x004067e0
                                                          0x00406910
                                                          0x00406910
                                                          0x00406910
                                                          0x00406910
                                                          0x00406913
                                                          0x00406913
                                                          0x00406916
                                                          0x00406918
                                                          0x00406ba2
                                                          0x00000000
                                                          0x00406ba2
                                                          0x0040691e
                                                          0x00406921
                                                          0x00000000
                                                          0x00000000
                                                          0x00406927
                                                          0x0040692b
                                                          0x0040692e
                                                          0x0040692e
                                                          0x0040692e
                                                          0x00000000
                                                          0x0040692e
                                                          0x004067ac
                                                          0x004067ae
                                                          0x004067b0
                                                          0x004067b2
                                                          0x004067b5
                                                          0x004067b6
                                                          0x004067b8
                                                          0x004067ba
                                                          0x004067bd
                                                          0x004067c0
                                                          0x004067d6
                                                          0x004067db
                                                          0x00406813
                                                          0x00406813
                                                          0x00406817
                                                          0x00406843
                                                          0x00406845
                                                          0x0040684c
                                                          0x0040684f
                                                          0x00406852
                                                          0x00406852
                                                          0x00406857
                                                          0x00406857
                                                          0x00406859
                                                          0x0040685c
                                                          0x00406863
                                                          0x00406866
                                                          0x00406893
                                                          0x00406893
                                                          0x00406896
                                                          0x00406899
                                                          0x0040690d
                                                          0x0040690d
                                                          0x0040690d
                                                          0x00000000
                                                          0x0040690d
                                                          0x0040689b
                                                          0x004068a1
                                                          0x004068a4
                                                          0x004068a7
                                                          0x004068aa
                                                          0x004068ad
                                                          0x004068b0
                                                          0x004068b3
                                                          0x004068b6
                                                          0x004068b9
                                                          0x004068bc
                                                          0x004068d5
                                                          0x004068d7
                                                          0x004068da
                                                          0x004068db
                                                          0x004068de
                                                          0x004068e0
                                                          0x004068e3
                                                          0x004068e5
                                                          0x004068e7
                                                          0x004068ea
                                                          0x004068ec
                                                          0x004068ef
                                                          0x004068f3
                                                          0x004068f5
                                                          0x004068f5
                                                          0x004068f6
                                                          0x004068f9
                                                          0x004068fc
                                                          0x004068be
                                                          0x004068be
                                                          0x004068c6
                                                          0x004068cb
                                                          0x004068cd
                                                          0x004068d0
                                                          0x004068d0
                                                          0x004068ff
                                                          0x00406906
                                                          0x00406890
                                                          0x00406890
                                                          0x00406890
                                                          0x00406890
                                                          0x00000000
                                                          0x00406908
                                                          0x00000000
                                                          0x00406908
                                                          0x00406906
                                                          0x00406819
                                                          0x0040681c
                                                          0x0040681e
                                                          0x00406821
                                                          0x00406824
                                                          0x00406827
                                                          0x00406829
                                                          0x0040682c
                                                          0x0040682f
                                                          0x0040682f
                                                          0x00406832
                                                          0x00406832
                                                          0x00406835
                                                          0x0040683c
                                                          0x00406810
                                                          0x00406810
                                                          0x00406810
                                                          0x00406810
                                                          0x00000000
                                                          0x0040683e
                                                          0x00000000
                                                          0x0040683e
                                                          0x0040683c
                                                          0x004067c2
                                                          0x004067c5
                                                          0x004067c7
                                                          0x004067ca
                                                          0x00000000
                                                          0x00000000
                                                          0x00406529
                                                          0x00406529
                                                          0x0040652d
                                                          0x00406b72
                                                          0x00000000
                                                          0x00406b72
                                                          0x00406533
                                                          0x00406536
                                                          0x00406539
                                                          0x0040653c
                                                          0x0040653f
                                                          0x00406542
                                                          0x00406545
                                                          0x00406547
                                                          0x0040654a
                                                          0x0040654d
                                                          0x00406550
                                                          0x00406552
                                                          0x00406552
                                                          0x00406552
                                                          0x00000000
                                                          0x00000000
                                                          0x004066b4
                                                          0x004066b4
                                                          0x004066b8
                                                          0x00406b7e
                                                          0x00000000
                                                          0x00406b7e
                                                          0x004066be
                                                          0x004066c1
                                                          0x004066c4
                                                          0x004066c7
                                                          0x004066c9
                                                          0x004066c9
                                                          0x004066c9
                                                          0x004066cc
                                                          0x004066cf
                                                          0x004066d2
                                                          0x004066d5
                                                          0x004066d8
                                                          0x004066db
                                                          0x004066dc
                                                          0x004066de
                                                          0x004066de
                                                          0x004066de
                                                          0x004066e1
                                                          0x004066e4
                                                          0x004066e7
                                                          0x004066ea
                                                          0x004066ea
                                                          0x004066ea
                                                          0x004066ed
                                                          0x004066ef
                                                          0x004066ef
                                                          0x00000000
                                                          0x00000000
                                                          0x00406931
                                                          0x00406931
                                                          0x00406931
                                                          0x00406935
                                                          0x00000000
                                                          0x00000000
                                                          0x0040693b
                                                          0x0040693e
                                                          0x00406941
                                                          0x00406944
                                                          0x00406946
                                                          0x00406946
                                                          0x00406946
                                                          0x00406949
                                                          0x0040694c
                                                          0x0040694f
                                                          0x00406952
                                                          0x00406955
                                                          0x00406958
                                                          0x00406959
                                                          0x0040695b
                                                          0x0040695b
                                                          0x0040695b
                                                          0x0040695e
                                                          0x00406961
                                                          0x00406964
                                                          0x00406967
                                                          0x0040696a
                                                          0x0040696e
                                                          0x00406970
                                                          0x00406973
                                                          0x00000000
                                                          0x00406975
                                                          0x004066f2
                                                          0x004066f2
                                                          0x00000000
                                                          0x004066f2
                                                          0x00406973
                                                          0x00406ba8
                                                          0x00406bca
                                                          0x00406bd0
                                                          0x00406bd2
                                                          0x00406bd9
                                                          0x00406bdb
                                                          0x00406be2
                                                          0x00406be6
                                                          0x00000000
                                                          0x004061d7
                                                          0x00406bdf
                                                          0x00406bdf
                                                          0x00000000
                                                          0x00406bdf
                                                          0x00406a2c
                                                          0x00406ab2
                                                          0x00406ab8
                                                          0x00406abb
                                                          0x00406abe
                                                          0x00406ac1
                                                          0x00406ac4
                                                          0x00406ac7
                                                          0x00406aca
                                                          0x00406acd
                                                          0x00406ad3
                                                          0x00406aec
                                                          0x00406aef
                                                          0x00406af2
                                                          0x00406af5
                                                          0x00406af9
                                                          0x00406afb
                                                          0x00406afc
                                                          0x00406aff
                                                          0x00406ad5
                                                          0x00406ad5
                                                          0x00406add
                                                          0x00406ae2
                                                          0x00406ae4
                                                          0x00406ae7
                                                          0x00406ae7
                                                          0x00406b09
                                                          0x00000000
                                                          0x00406b0b
                                                          0x00000000
                                                          0x00406b0b
                                                          0x00406b09
                                                          0x00000000
                                                          0x0040697e

                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: db4b2f824491321a50731860d46817135270c8e97721ba662834ece50dc26027
                                                          • Instruction ID: e89747aace1fce0fcb13a8d80e6f88749465aa03c559881c8099c8d07fdfb4d2
                                                          • Opcode Fuzzy Hash: db4b2f824491321a50731860d46817135270c8e97721ba662834ece50dc26027
                                                          • Instruction Fuzzy Hash: BE911070E04228CBDF28DF98C8547ADBBB1FB44305F15816ED816BB281C778AA96DF44
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00406690 Relevance: 5.2, APIs: 4, Instructions: 205COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 98%
                                                          			E00406690() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M00406BE7))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4)); // executed
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8)); // executed
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}













                                                          0x00000000
                                                          0x00406690
                                                          0x00406690
                                                          0x00406694
                                                          0x0040674b
                                                          0x0040674e
                                                          0x0040675a
                                                          0x0040663b
                                                          0x0040663b
                                                          0x0040663e
                                                          0x004069b0
                                                          0x004069b0
                                                          0x004069b3
                                                          0x004069b3
                                                          0x004069b9
                                                          0x004069bf
                                                          0x004069c5
                                                          0x004069df
                                                          0x004069e2
                                                          0x004069e8
                                                          0x004069f3
                                                          0x004069f5
                                                          0x004069c7
                                                          0x004069c7
                                                          0x004069d6
                                                          0x004069da
                                                          0x004069da
                                                          0x004069ff
                                                          0x00406a26
                                                          0x00406a26
                                                          0x00406a2c
                                                          0x00406a2c
                                                          0x00000000
                                                          0x00406a01
                                                          0x00406a01
                                                          0x00406a05
                                                          0x00406bb4
                                                          0x00000000
                                                          0x00406bb4
                                                          0x00406a11
                                                          0x00406a18
                                                          0x00406a20
                                                          0x00406a23
                                                          0x00000000
                                                          0x00406a23
                                                          0x0040669a
                                                          0x0040669e
                                                          0x00406bdf
                                                          0x00406bdf
                                                          0x00406be2
                                                          0x00406be6
                                                          0x00406be6
                                                          0x004066a4
                                                          0x004066aa
                                                          0x004066ad
                                                          0x004066b1
                                                          0x004066b4
                                                          0x004066b8
                                                          0x00406b7e
                                                          0x00406bca
                                                          0x00406bd2
                                                          0x00406bd9
                                                          0x00406bdb
                                                          0x00000000
                                                          0x00406bdb
                                                          0x004066be
                                                          0x004066c1
                                                          0x004066c7
                                                          0x004066c9
                                                          0x004066c9
                                                          0x004066cc
                                                          0x004066cf
                                                          0x004066d2
                                                          0x004066d5
                                                          0x004066d8
                                                          0x004066db
                                                          0x004066dc
                                                          0x004066de
                                                          0x004066de
                                                          0x004066de
                                                          0x004066e1
                                                          0x004066e4
                                                          0x004066e7
                                                          0x004066ea
                                                          0x004066ea
                                                          0x004066ed
                                                          0x004066ef
                                                          0x004066ef
                                                          0x004066f2
                                                          0x004066f2
                                                          0x004066f2
                                                          0x004061c8
                                                          0x004061c8
                                                          0x004061d1
                                                          0x00000000
                                                          0x00000000
                                                          0x004061d7
                                                          0x00000000
                                                          0x004061e2
                                                          0x00000000
                                                          0x00000000
                                                          0x004061eb
                                                          0x004061ee
                                                          0x004061f1
                                                          0x004061f5
                                                          0x00000000
                                                          0x00000000
                                                          0x004061fb
                                                          0x004061fe
                                                          0x00406200
                                                          0x00406201
                                                          0x00406204
                                                          0x00406206
                                                          0x00406207
                                                          0x00406209
                                                          0x0040620c
                                                          0x00406211
                                                          0x00406216
                                                          0x0040621f
                                                          0x00406232
                                                          0x00406235
                                                          0x00406241
                                                          0x00406269
                                                          0x0040626b
                                                          0x00406279
                                                          0x00406279
                                                          0x0040627d
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040626d
                                                          0x0040626d
                                                          0x00406270
                                                          0x00406271
                                                          0x00406271
                                                          0x00000000
                                                          0x0040626d
                                                          0x00406247
                                                          0x0040624c
                                                          0x0040624c
                                                          0x00406255
                                                          0x0040625d
                                                          0x00406260
                                                          0x00000000
                                                          0x00406266
                                                          0x00406266
                                                          0x00000000
                                                          0x00406266
                                                          0x00000000
                                                          0x00406283
                                                          0x00406283
                                                          0x00406287
                                                          0x00406b33
                                                          0x00000000
                                                          0x00406b33
                                                          0x00406290
                                                          0x004062a0
                                                          0x004062a3
                                                          0x004062a6
                                                          0x004062a6
                                                          0x004062a6
                                                          0x004062a9
                                                          0x004062ad
                                                          0x00000000
                                                          0x00000000
                                                          0x004062af
                                                          0x004062b5
                                                          0x004062df
                                                          0x004062e5
                                                          0x004062ec
                                                          0x00000000
                                                          0x004062ec
                                                          0x004062bb
                                                          0x004062be
                                                          0x004062c3
                                                          0x004062c3
                                                          0x004062ce
                                                          0x004062d6
                                                          0x004062d9
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040631e
                                                          0x00406324
                                                          0x00406327
                                                          0x00406334
                                                          0x0040633c
                                                          0x00000000
                                                          0x00000000
                                                          0x004062f3
                                                          0x004062f3
                                                          0x004062f7
                                                          0x00406b42
                                                          0x00000000
                                                          0x00406b42
                                                          0x00406303
                                                          0x0040630e
                                                          0x0040630e
                                                          0x0040630e
                                                          0x00406311
                                                          0x00406314
                                                          0x00406317
                                                          0x0040631c
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00406344
                                                          0x00406346
                                                          0x00406349
                                                          0x004063ba
                                                          0x004063bd
                                                          0x004063c0
                                                          0x004063c7
                                                          0x004063d1
                                                          0x00000000
                                                          0x004063d1
                                                          0x0040634b
                                                          0x0040634f
                                                          0x00406352
                                                          0x00406354
                                                          0x00406357
                                                          0x0040635a
                                                          0x0040635c
                                                          0x0040635f
                                                          0x00406361
                                                          0x00406366
                                                          0x00406369
                                                          0x0040636c
                                                          0x00406370
                                                          0x00406377
                                                          0x0040637a
                                                          0x00406381
                                                          0x00406385
                                                          0x0040638d
                                                          0x0040638d
                                                          0x0040638d
                                                          0x00406387
                                                          0x00406387
                                                          0x00406387
                                                          0x0040637c
                                                          0x0040637c
                                                          0x0040637c
                                                          0x00406391
                                                          0x00406394
                                                          0x004063b2
                                                          0x004063b4
                                                          0x00000000
                                                          0x00406396
                                                          0x00406396
                                                          0x00406399
                                                          0x0040639c
                                                          0x0040639f
                                                          0x004063a1
                                                          0x004063a1
                                                          0x004063a1
                                                          0x004063a4
                                                          0x004063a7
                                                          0x004063a9
                                                          0x004063aa
                                                          0x004063ad
                                                          0x00000000
                                                          0x004063ad
                                                          0x00000000
                                                          0x004065e3
                                                          0x004065e7
                                                          0x00406605
                                                          0x00406608
                                                          0x0040660f
                                                          0x00406612
                                                          0x00406615
                                                          0x00406618
                                                          0x0040661b
                                                          0x0040661e
                                                          0x00406620
                                                          0x00406627
                                                          0x00406628
                                                          0x0040662a
                                                          0x0040662d
                                                          0x00406630
                                                          0x00406633
                                                          0x00406633
                                                          0x00406638
                                                          0x00000000
                                                          0x00406638
                                                          0x004065e9
                                                          0x004065ec
                                                          0x004065ef
                                                          0x004065f9
                                                          0x00000000
                                                          0x00000000
                                                          0x0040664d
                                                          0x00406651
                                                          0x00406674
                                                          0x00406677
                                                          0x0040667a
                                                          0x00406684
                                                          0x00406653
                                                          0x00406653
                                                          0x00406656
                                                          0x00406659
                                                          0x0040665c
                                                          0x00406669
                                                          0x0040666c
                                                          0x0040666c
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00406701
                                                          0x00406705
                                                          0x0040670c
                                                          0x0040670f
                                                          0x00406712
                                                          0x0040671c
                                                          0x00000000
                                                          0x0040671c
                                                          0x00406707
                                                          0x00000000
                                                          0x00000000
                                                          0x00406728
                                                          0x0040672c
                                                          0x00406733
                                                          0x00406736
                                                          0x00406739
                                                          0x0040672e
                                                          0x0040672e
                                                          0x0040672e
                                                          0x0040673c
                                                          0x0040673f
                                                          0x00406742
                                                          0x00406742
                                                          0x00406745
                                                          0x00406748
                                                          0x00000000
                                                          0x00000000
                                                          0x004067e8
                                                          0x004067e8
                                                          0x004067ec
                                                          0x00406b8a
                                                          0x00000000
                                                          0x00406b8a
                                                          0x004067f2
                                                          0x004067f5
                                                          0x004067f8
                                                          0x004067fc
                                                          0x004067ff
                                                          0x00406805
                                                          0x00406807
                                                          0x00406807
                                                          0x00406807
                                                          0x0040680a
                                                          0x0040680d
                                                          0x00000000
                                                          0x00000000
                                                          0x004063dd
                                                          0x004063dd
                                                          0x004063e1
                                                          0x00406b4e
                                                          0x00000000
                                                          0x00406b4e
                                                          0x004063e7
                                                          0x004063ea
                                                          0x004063ed
                                                          0x004063f1
                                                          0x004063f4
                                                          0x004063fa
                                                          0x004063fc
                                                          0x004063fc
                                                          0x004063fc
                                                          0x004063ff
                                                          0x00406402
                                                          0x00406402
                                                          0x00406405
                                                          0x00406408
                                                          0x00000000
                                                          0x00000000
                                                          0x0040640e
                                                          0x00406414
                                                          0x00000000
                                                          0x00000000
                                                          0x0040641a
                                                          0x0040641a
                                                          0x0040641e
                                                          0x00406421
                                                          0x00406424
                                                          0x00406427
                                                          0x0040642a
                                                          0x0040642b
                                                          0x0040642e
                                                          0x00406430
                                                          0x00406436
                                                          0x00406439
                                                          0x0040643c
                                                          0x0040643f
                                                          0x00406442
                                                          0x00406445
                                                          0x00406448
                                                          0x00406464
                                                          0x00406467
                                                          0x0040646a
                                                          0x0040646d
                                                          0x00406474
                                                          0x00406478
                                                          0x0040647a
                                                          0x0040647e
                                                          0x0040644a
                                                          0x0040644a
                                                          0x0040644e
                                                          0x00406456
                                                          0x0040645b
                                                          0x0040645d
                                                          0x0040645f
                                                          0x0040645f
                                                          0x00406481
                                                          0x00406488
                                                          0x0040648b
                                                          0x00000000
                                                          0x00406491
                                                          0x00000000
                                                          0x00406491
                                                          0x00000000
                                                          0x00406496
                                                          0x00406496
                                                          0x0040649a
                                                          0x00406b5a
                                                          0x00000000
                                                          0x00406b5a
                                                          0x004064a0
                                                          0x004064a3
                                                          0x004064a6
                                                          0x004064aa
                                                          0x004064ad
                                                          0x004064b3
                                                          0x004064b5
                                                          0x004064b5
                                                          0x004064b5
                                                          0x004064b8
                                                          0x004064bb
                                                          0x004064bb
                                                          0x004064bb
                                                          0x004064c1
                                                          0x00000000
                                                          0x00000000
                                                          0x004064c3
                                                          0x004064c6
                                                          0x004064c9
                                                          0x004064cc
                                                          0x004064cf
                                                          0x004064d2
                                                          0x004064d5
                                                          0x004064d8
                                                          0x004064db
                                                          0x004064de
                                                          0x004064e1
                                                          0x004064f9
                                                          0x004064fc
                                                          0x004064ff
                                                          0x00406502
                                                          0x00406502
                                                          0x00406505
                                                          0x00406509
                                                          0x0040650b
                                                          0x004064e3
                                                          0x004064e3
                                                          0x004064eb
                                                          0x004064f0
                                                          0x004064f2
                                                          0x004064f4
                                                          0x004064f4
                                                          0x0040650e
                                                          0x00406515
                                                          0x00406518
                                                          0x00000000
                                                          0x0040651a
                                                          0x00000000
                                                          0x0040651a
                                                          0x00406518
                                                          0x0040651f
                                                          0x0040651f
                                                          0x0040651f
                                                          0x0040651f
                                                          0x00000000
                                                          0x00000000
                                                          0x0040655a
                                                          0x0040655a
                                                          0x0040655e
                                                          0x00406b66
                                                          0x00000000
                                                          0x00406b66
                                                          0x00406564
                                                          0x00406567
                                                          0x0040656a
                                                          0x0040656e
                                                          0x00406571
                                                          0x00406577
                                                          0x00406579
                                                          0x00406579
                                                          0x00406579
                                                          0x0040657c
                                                          0x0040657f
                                                          0x0040657f
                                                          0x00406585
                                                          0x00406523
                                                          0x00406523
                                                          0x00406526
                                                          0x00000000
                                                          0x00406526
                                                          0x00406587
                                                          0x00406587
                                                          0x0040658a
                                                          0x0040658d
                                                          0x00406590
                                                          0x00406593
                                                          0x00406596
                                                          0x00406599
                                                          0x0040659c
                                                          0x0040659f
                                                          0x004065a2
                                                          0x004065a5
                                                          0x004065bd
                                                          0x004065c0
                                                          0x004065c3
                                                          0x004065c6
                                                          0x004065c6
                                                          0x004065c9
                                                          0x004065cd
                                                          0x004065cf
                                                          0x004065a7
                                                          0x004065a7
                                                          0x004065af
                                                          0x004065b4
                                                          0x004065b6
                                                          0x004065b8
                                                          0x004065b8
                                                          0x004065d2
                                                          0x004065d9
                                                          0x004065dc
                                                          0x00000000
                                                          0x004065de
                                                          0x00000000
                                                          0x004065de
                                                          0x00000000
                                                          0x0040686b
                                                          0x0040686b
                                                          0x0040686f
                                                          0x00406b96
                                                          0x00000000
                                                          0x00406b96
                                                          0x00406875
                                                          0x00406878
                                                          0x0040687b
                                                          0x0040687f
                                                          0x00406882
                                                          0x00406888
                                                          0x0040688a
                                                          0x0040688a
                                                          0x0040688a
                                                          0x0040688d
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040697a
                                                          0x0040697e
                                                          0x004069a0
                                                          0x004069a3
                                                          0x004069ad
                                                          0x00000000
                                                          0x004069ad
                                                          0x00406980
                                                          0x00406983
                                                          0x00406987
                                                          0x0040698a
                                                          0x0040698a
                                                          0x0040698d
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a37
                                                          0x00406a3b
                                                          0x00406a59
                                                          0x00406a59
                                                          0x00406a59
                                                          0x00406a60
                                                          0x00406a67
                                                          0x00406a6e
                                                          0x00406a6e
                                                          0x00000000
                                                          0x00406a6e
                                                          0x00406a3d
                                                          0x00406a40
                                                          0x00406a43
                                                          0x00406a46
                                                          0x00406a4d
                                                          0x00406991
                                                          0x00406991
                                                          0x00406994
                                                          0x00000000
                                                          0x00000000
                                                          0x00406b28
                                                          0x00406b2b
                                                          0x00000000
                                                          0x00000000
                                                          0x00406762
                                                          0x00406764
                                                          0x0040676b
                                                          0x0040676c
                                                          0x0040676e
                                                          0x00406771
                                                          0x00000000
                                                          0x00000000
                                                          0x00406779
                                                          0x0040677c
                                                          0x0040677f
                                                          0x00406781
                                                          0x00406783
                                                          0x00406783
                                                          0x00406784
                                                          0x00406787
                                                          0x0040678e
                                                          0x00406791
                                                          0x0040679f
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a75
                                                          0x00406a75
                                                          0x00406a78
                                                          0x00406a7f
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a84
                                                          0x00406a84
                                                          0x00406a88
                                                          0x00406bc0
                                                          0x00000000
                                                          0x00406bc0
                                                          0x00406a8e
                                                          0x00406a91
                                                          0x00406a94
                                                          0x00406a98
                                                          0x00406a9b
                                                          0x00406aa1
                                                          0x00406aa3
                                                          0x00406aa3
                                                          0x00406aa3
                                                          0x00406aa6
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aac
                                                          0x00406aac
                                                          0x00406ab0
                                                          0x00406b10
                                                          0x00406b13
                                                          0x00406b18
                                                          0x00406b19
                                                          0x00406b1b
                                                          0x00406b1d
                                                          0x00406b20
                                                          0x00000000
                                                          0x00406b20
                                                          0x00406ab2
                                                          0x00406ab8
                                                          0x00406abb
                                                          0x00406abe
                                                          0x00406ac1
                                                          0x00406ac4
                                                          0x00406ac7
                                                          0x00406aca
                                                          0x00406acd
                                                          0x00406ad0
                                                          0x00406ad3
                                                          0x00406aec
                                                          0x00406aef
                                                          0x00406af2
                                                          0x00406af5
                                                          0x00406af9
                                                          0x00406afb
                                                          0x00406afb
                                                          0x00406afc
                                                          0x00406aff
                                                          0x00406ad5
                                                          0x00406ad5
                                                          0x00406add
                                                          0x00406ae2
                                                          0x00406ae4
                                                          0x00406ae7
                                                          0x00406ae7
                                                          0x00406b02
                                                          0x00406b09
                                                          0x00000000
                                                          0x00406b0b
                                                          0x00000000
                                                          0x00406b0b
                                                          0x00000000
                                                          0x004067a7
                                                          0x004067aa
                                                          0x004067e0
                                                          0x00406910
                                                          0x00406910
                                                          0x00406910
                                                          0x00406910
                                                          0x00406913
                                                          0x00406913
                                                          0x00406916
                                                          0x00406918
                                                          0x00406ba2
                                                          0x00000000
                                                          0x00406ba2
                                                          0x0040691e
                                                          0x00406921
                                                          0x00000000
                                                          0x00000000
                                                          0x00406927
                                                          0x0040692b
                                                          0x0040692e
                                                          0x0040692e
                                                          0x0040692e
                                                          0x00000000
                                                          0x0040692e
                                                          0x004067ac
                                                          0x004067ae
                                                          0x004067b0
                                                          0x004067b2
                                                          0x004067b5
                                                          0x004067b6
                                                          0x004067b8
                                                          0x004067ba
                                                          0x004067bd
                                                          0x004067c0
                                                          0x004067d6
                                                          0x004067db
                                                          0x00406813
                                                          0x00406813
                                                          0x00406817
                                                          0x00406843
                                                          0x00406845
                                                          0x0040684c
                                                          0x0040684f
                                                          0x00406852
                                                          0x00406852
                                                          0x00406857
                                                          0x00406857
                                                          0x00406859
                                                          0x0040685c
                                                          0x00406863
                                                          0x00406866
                                                          0x00406893
                                                          0x00406893
                                                          0x00406896
                                                          0x00406899
                                                          0x0040690d
                                                          0x0040690d
                                                          0x0040690d
                                                          0x00000000
                                                          0x0040690d
                                                          0x0040689b
                                                          0x004068a1
                                                          0x004068a4
                                                          0x004068a7
                                                          0x004068aa
                                                          0x004068ad
                                                          0x004068b0
                                                          0x004068b3
                                                          0x004068b6
                                                          0x004068b9
                                                          0x004068bc
                                                          0x004068d5
                                                          0x004068d7
                                                          0x004068da
                                                          0x004068db
                                                          0x004068de
                                                          0x004068e0
                                                          0x004068e3
                                                          0x004068e5
                                                          0x004068e7
                                                          0x004068ea
                                                          0x004068ec
                                                          0x004068ef
                                                          0x004068f3
                                                          0x004068f5
                                                          0x004068f5
                                                          0x004068f6
                                                          0x004068f9
                                                          0x004068fc
                                                          0x004068be
                                                          0x004068be
                                                          0x004068c6
                                                          0x004068cb
                                                          0x004068cd
                                                          0x004068d0
                                                          0x004068d0
                                                          0x004068ff
                                                          0x00406906
                                                          0x00406890
                                                          0x00406890
                                                          0x00406890
                                                          0x00406890
                                                          0x00000000
                                                          0x00406908
                                                          0x00000000
                                                          0x00406908
                                                          0x00406906
                                                          0x00406819
                                                          0x0040681c
                                                          0x0040681e
                                                          0x00406821
                                                          0x00406824
                                                          0x00406827
                                                          0x00406829
                                                          0x0040682c
                                                          0x0040682f
                                                          0x0040682f
                                                          0x00406832
                                                          0x00406832
                                                          0x00406835
                                                          0x0040683c
                                                          0x00406810
                                                          0x00406810
                                                          0x00406810
                                                          0x00406810
                                                          0x00000000
                                                          0x0040683e
                                                          0x00000000
                                                          0x0040683e
                                                          0x0040683c
                                                          0x004067c2
                                                          0x004067c5
                                                          0x004067c7
                                                          0x004067ca
                                                          0x00000000
                                                          0x00000000
                                                          0x00406529
                                                          0x00406529
                                                          0x0040652d
                                                          0x00406b72
                                                          0x00000000
                                                          0x00406b72
                                                          0x00406533
                                                          0x00406536
                                                          0x00406539
                                                          0x0040653c
                                                          0x0040653f
                                                          0x00406542
                                                          0x00406545
                                                          0x00406547
                                                          0x0040654a
                                                          0x0040654d
                                                          0x00406550
                                                          0x00406552
                                                          0x00406552
                                                          0x00406552
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00406931
                                                          0x00406931
                                                          0x00406931
                                                          0x00406935
                                                          0x00000000
                                                          0x00000000
                                                          0x0040693b
                                                          0x0040693e
                                                          0x00406941
                                                          0x00406944
                                                          0x00406946
                                                          0x00406946
                                                          0x00406946
                                                          0x00406949
                                                          0x0040694c
                                                          0x0040694f
                                                          0x00406952
                                                          0x00406955
                                                          0x00406958
                                                          0x00406959
                                                          0x0040695b
                                                          0x0040695b
                                                          0x0040695b
                                                          0x0040695e
                                                          0x00406961
                                                          0x00406964
                                                          0x00406967
                                                          0x0040696a
                                                          0x0040696e
                                                          0x00406970
                                                          0x00406973
                                                          0x00000000
                                                          0x00406975
                                                          0x00000000
                                                          0x00406975
                                                          0x00406973
                                                          0x00406ba8
                                                          0x00000000
                                                          0x00000000
                                                          0x004061d7

                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: adca5b2b6989107afceee3a061708c38461c5fc9fc0daf484043dfdf7e09805a
                                                          • Instruction ID: d456333056e0522eb9a81365918d8492ce98a85054e5b278218ea4b7938feab7
                                                          • Opcode Fuzzy Hash: adca5b2b6989107afceee3a061708c38461c5fc9fc0daf484043dfdf7e09805a
                                                          • Instruction Fuzzy Hash: E1814671D04228CFDF24CFA8C8847ADBBB1FB44305F25816AD416BB281C778AA96DF44
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00406195 Relevance: 5.2, APIs: 4, Instructions: 198COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 98%
                                                          			E00406195(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M00406BE7))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8); // executed
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12); // executed
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}










































                                                          0x004061a5
                                                          0x004061ac
                                                          0x004061b2
                                                          0x004061b8
                                                          0x00000000
                                                          0x004061bc
                                                          0x004061c8
                                                          0x004061c8
                                                          0x004061c8
                                                          0x004061d1
                                                          0x00000000
                                                          0x00000000
                                                          0x004061d7
                                                          0x00000000
                                                          0x004061de
                                                          0x004061e2
                                                          0x00000000
                                                          0x00000000
                                                          0x004061eb
                                                          0x004061ee
                                                          0x004061f1
                                                          0x004061f3
                                                          0x004061f5
                                                          0x00000000
                                                          0x00000000
                                                          0x004061fb
                                                          0x004061fe
                                                          0x00406200
                                                          0x00406201
                                                          0x00406204
                                                          0x00406206
                                                          0x00406207
                                                          0x00406209
                                                          0x0040620c
                                                          0x00406211
                                                          0x00406216
                                                          0x0040621f
                                                          0x00406232
                                                          0x00406235
                                                          0x0040623e
                                                          0x00406241
                                                          0x00406269
                                                          0x00406269
                                                          0x0040626b
                                                          0x00406279
                                                          0x00406279
                                                          0x0040627d
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040626d
                                                          0x0040626d
                                                          0x00406270
                                                          0x00406270
                                                          0x00406271
                                                          0x00406271
                                                          0x00000000
                                                          0x0040626d
                                                          0x00406243
                                                          0x00406247
                                                          0x0040624c
                                                          0x0040624c
                                                          0x00406255
                                                          0x0040625b
                                                          0x0040625d
                                                          0x00406260
                                                          0x00000000
                                                          0x00406266
                                                          0x00406266
                                                          0x00000000
                                                          0x00406266
                                                          0x00000000
                                                          0x00406283
                                                          0x00406283
                                                          0x00406287
                                                          0x00406b33
                                                          0x00000000
                                                          0x00406b33
                                                          0x00406290
                                                          0x004062a0
                                                          0x004062a3
                                                          0x004062a6
                                                          0x004062a6
                                                          0x004062a6
                                                          0x004062a9
                                                          0x004062a9
                                                          0x004062ad
                                                          0x00000000
                                                          0x00000000
                                                          0x004062af
                                                          0x004062b2
                                                          0x004062b5
                                                          0x004062df
                                                          0x004062e5
                                                          0x004062ec
                                                          0x00000000
                                                          0x004062ec
                                                          0x004062b7
                                                          0x004062bb
                                                          0x004062be
                                                          0x004062c3
                                                          0x004062c3
                                                          0x004062ce
                                                          0x004062d4
                                                          0x004062d6
                                                          0x004062d9
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040631e
                                                          0x00406324
                                                          0x00406327
                                                          0x00406334
                                                          0x0040633c
                                                          0x00000000
                                                          0x00000000
                                                          0x004062f3
                                                          0x004062f3
                                                          0x004062f7
                                                          0x00406b42
                                                          0x00000000
                                                          0x00406b42
                                                          0x00406303
                                                          0x0040630e
                                                          0x0040630e
                                                          0x0040630e
                                                          0x00406311
                                                          0x00406314
                                                          0x00406317
                                                          0x0040631a
                                                          0x0040631c
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x004069b3
                                                          0x004069b3
                                                          0x004069b9
                                                          0x004069bf
                                                          0x004069c2
                                                          0x004069c5
                                                          0x004069df
                                                          0x004069e2
                                                          0x004069e8
                                                          0x004069f3
                                                          0x004069f3
                                                          0x004069f5
                                                          0x004069c7
                                                          0x004069c7
                                                          0x004069d6
                                                          0x004069da
                                                          0x004069da
                                                          0x004069f8
                                                          0x004069ff
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a01
                                                          0x00406a01
                                                          0x00406a05
                                                          0x00406bb4
                                                          0x00000000
                                                          0x00406bb4
                                                          0x00406a11
                                                          0x00406a18
                                                          0x00406a20
                                                          0x00406a20
                                                          0x00406a20
                                                          0x00406a23
                                                          0x00406a26
                                                          0x00406a26
                                                          0x00000000
                                                          0x00000000
                                                          0x00406344
                                                          0x00406346
                                                          0x00406349
                                                          0x004063ba
                                                          0x004063bd
                                                          0x004063c0
                                                          0x004063c7
                                                          0x004063d1
                                                          0x00000000
                                                          0x004063d1
                                                          0x0040634b
                                                          0x0040634f
                                                          0x00406352
                                                          0x00406354
                                                          0x00406357
                                                          0x0040635a
                                                          0x0040635c
                                                          0x0040635f
                                                          0x00406361
                                                          0x00406366
                                                          0x00406369
                                                          0x0040636c
                                                          0x00406370
                                                          0x00406377
                                                          0x0040637a
                                                          0x00406381
                                                          0x00406385
                                                          0x0040638d
                                                          0x0040638d
                                                          0x0040638d
                                                          0x00406387
                                                          0x00406387
                                                          0x00406387
                                                          0x0040637c
                                                          0x0040637c
                                                          0x0040637c
                                                          0x00406391
                                                          0x00406394
                                                          0x004063b2
                                                          0x004063b4
                                                          0x00000000
                                                          0x004063b4
                                                          0x00406396
                                                          0x00406399
                                                          0x0040639c
                                                          0x0040639f
                                                          0x004063a1
                                                          0x004063a1
                                                          0x004063a1
                                                          0x004063a4
                                                          0x004063a7
                                                          0x004063a9
                                                          0x004063aa
                                                          0x004063ad
                                                          0x00000000
                                                          0x00000000
                                                          0x004065e3
                                                          0x004065e7
                                                          0x00406605
                                                          0x00406608
                                                          0x0040660f
                                                          0x00406612
                                                          0x00406615
                                                          0x00406618
                                                          0x0040661b
                                                          0x0040661e
                                                          0x00406620
                                                          0x00406627
                                                          0x00406628
                                                          0x0040662a
                                                          0x0040662d
                                                          0x00406630
                                                          0x00406633
                                                          0x00406633
                                                          0x00406638
                                                          0x00000000
                                                          0x00406638
                                                          0x004065e9
                                                          0x004065ec
                                                          0x004065ef
                                                          0x004065f9
                                                          0x00000000
                                                          0x00000000
                                                          0x0040664d
                                                          0x00406651
                                                          0x00406674
                                                          0x00406677
                                                          0x0040667a
                                                          0x00406684
                                                          0x00406653
                                                          0x00406653
                                                          0x00406656
                                                          0x00406659
                                                          0x0040665c
                                                          0x00406669
                                                          0x0040666c
                                                          0x0040666c
                                                          0x00000000
                                                          0x00000000
                                                          0x00406690
                                                          0x00406694
                                                          0x00000000
                                                          0x00000000
                                                          0x0040669a
                                                          0x0040669e
                                                          0x00000000
                                                          0x00000000
                                                          0x004066a4
                                                          0x004066a6
                                                          0x004066aa
                                                          0x004066aa
                                                          0x004066ad
                                                          0x004066b1
                                                          0x00000000
                                                          0x00000000
                                                          0x00406701
                                                          0x00406705
                                                          0x0040670c
                                                          0x0040670f
                                                          0x00406712
                                                          0x0040671c
                                                          0x00000000
                                                          0x0040671c
                                                          0x00406707
                                                          0x00000000
                                                          0x00000000
                                                          0x00406728
                                                          0x0040672c
                                                          0x00406733
                                                          0x00406736
                                                          0x00406739
                                                          0x0040672e
                                                          0x0040672e
                                                          0x0040672e
                                                          0x0040673c
                                                          0x0040673f
                                                          0x00406742
                                                          0x00406742
                                                          0x00406745
                                                          0x00406748
                                                          0x0040674b
                                                          0x0040674b
                                                          0x0040674e
                                                          0x00406755
                                                          0x0040675a
                                                          0x00000000
                                                          0x00000000
                                                          0x004067e8
                                                          0x004067e8
                                                          0x004067ec
                                                          0x00406b8a
                                                          0x00000000
                                                          0x00406b8a
                                                          0x004067f2
                                                          0x004067f5
                                                          0x004067f8
                                                          0x004067fc
                                                          0x004067ff
                                                          0x00406805
                                                          0x00406807
                                                          0x00406807
                                                          0x00406807
                                                          0x0040680a
                                                          0x0040680d
                                                          0x00000000
                                                          0x00000000
                                                          0x004063dd
                                                          0x004063dd
                                                          0x004063e1
                                                          0x00406b4e
                                                          0x00000000
                                                          0x00406b4e
                                                          0x004063e7
                                                          0x004063ea
                                                          0x004063ed
                                                          0x004063f1
                                                          0x004063f4
                                                          0x004063fa
                                                          0x004063fc
                                                          0x004063fc
                                                          0x004063fc
                                                          0x004063ff
                                                          0x00406402
                                                          0x00406402
                                                          0x00406405
                                                          0x00406408
                                                          0x00000000
                                                          0x00000000
                                                          0x0040640e
                                                          0x00406414
                                                          0x00000000
                                                          0x00000000
                                                          0x0040641a
                                                          0x0040641a
                                                          0x0040641e
                                                          0x00406421
                                                          0x00406424
                                                          0x00406427
                                                          0x0040642a
                                                          0x0040642b
                                                          0x0040642e
                                                          0x00406430
                                                          0x00406436
                                                          0x00406439
                                                          0x0040643c
                                                          0x0040643f
                                                          0x00406442
                                                          0x00406445
                                                          0x00406448
                                                          0x00406464
                                                          0x00406467
                                                          0x0040646a
                                                          0x0040646d
                                                          0x00406474
                                                          0x00406478
                                                          0x0040647a
                                                          0x0040647e
                                                          0x0040644a
                                                          0x0040644a
                                                          0x0040644e
                                                          0x00406456
                                                          0x0040645b
                                                          0x0040645d
                                                          0x0040645f
                                                          0x0040645f
                                                          0x00406481
                                                          0x00406488
                                                          0x0040648b
                                                          0x00000000
                                                          0x00406491
                                                          0x00000000
                                                          0x00406491
                                                          0x00000000
                                                          0x00406496
                                                          0x00406496
                                                          0x0040649a
                                                          0x00406b5a
                                                          0x00000000
                                                          0x00406b5a
                                                          0x004064a0
                                                          0x004064a3
                                                          0x004064a6
                                                          0x004064aa
                                                          0x004064ad
                                                          0x004064b3
                                                          0x004064b5
                                                          0x004064b5
                                                          0x004064b5
                                                          0x004064b8
                                                          0x004064bb
                                                          0x004064bb
                                                          0x004064bb
                                                          0x004064c1
                                                          0x00000000
                                                          0x00000000
                                                          0x004064c3
                                                          0x004064c6
                                                          0x004064c9
                                                          0x004064cc
                                                          0x004064cf
                                                          0x004064d2
                                                          0x004064d5
                                                          0x004064d8
                                                          0x004064db
                                                          0x004064de
                                                          0x004064e1
                                                          0x004064f9
                                                          0x004064fc
                                                          0x004064ff
                                                          0x00406502
                                                          0x00406502
                                                          0x00406505
                                                          0x00406509
                                                          0x0040650b
                                                          0x004064e3
                                                          0x004064e3
                                                          0x004064eb
                                                          0x004064f0
                                                          0x004064f2
                                                          0x004064f4
                                                          0x004064f4
                                                          0x0040650e
                                                          0x00406515
                                                          0x00406518
                                                          0x00000000
                                                          0x0040651a
                                                          0x00000000
                                                          0x0040651a
                                                          0x00406518
                                                          0x0040651f
                                                          0x0040651f
                                                          0x0040651f
                                                          0x0040651f
                                                          0x00000000
                                                          0x00000000
                                                          0x0040655a
                                                          0x0040655a
                                                          0x0040655e
                                                          0x00406b66
                                                          0x00000000
                                                          0x00406b66
                                                          0x00406564
                                                          0x00406567
                                                          0x0040656a
                                                          0x0040656e
                                                          0x00406571
                                                          0x00406577
                                                          0x00406579
                                                          0x00406579
                                                          0x00406579
                                                          0x0040657c
                                                          0x0040657f
                                                          0x0040657f
                                                          0x00406585
                                                          0x00406523
                                                          0x00406523
                                                          0x00406526
                                                          0x00000000
                                                          0x00406526
                                                          0x00406587
                                                          0x00406587
                                                          0x0040658a
                                                          0x0040658d
                                                          0x00406590
                                                          0x00406593
                                                          0x00406596
                                                          0x00406599
                                                          0x0040659c
                                                          0x0040659f
                                                          0x004065a2
                                                          0x004065a5
                                                          0x004065bd
                                                          0x004065c0
                                                          0x004065c3
                                                          0x004065c6
                                                          0x004065c6
                                                          0x004065c9
                                                          0x004065cd
                                                          0x004065cf
                                                          0x004065a7
                                                          0x004065a7
                                                          0x004065af
                                                          0x004065b4
                                                          0x004065b6
                                                          0x004065b8
                                                          0x004065b8
                                                          0x004065d2
                                                          0x004065d9
                                                          0x004065dc
                                                          0x00000000
                                                          0x004065de
                                                          0x00000000
                                                          0x004065de
                                                          0x00000000
                                                          0x0040686b
                                                          0x0040686b
                                                          0x0040686f
                                                          0x00406b96
                                                          0x00000000
                                                          0x00406b96
                                                          0x00406875
                                                          0x00406878
                                                          0x0040687b
                                                          0x0040687f
                                                          0x00406882
                                                          0x00406888
                                                          0x0040688a
                                                          0x0040688a
                                                          0x0040688a
                                                          0x0040688d
                                                          0x00000000
                                                          0x00000000
                                                          0x0040663b
                                                          0x0040663b
                                                          0x0040663e
                                                          0x00000000
                                                          0x00000000
                                                          0x0040697a
                                                          0x0040697e
                                                          0x004069a0
                                                          0x004069a3
                                                          0x004069ad
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00000000
                                                          0x004069b0
                                                          0x00406980
                                                          0x00406983
                                                          0x00406987
                                                          0x0040698a
                                                          0x0040698a
                                                          0x0040698d
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a37
                                                          0x00406a3b
                                                          0x00406a59
                                                          0x00406a59
                                                          0x00406a59
                                                          0x00406a60
                                                          0x00406a67
                                                          0x00406a6e
                                                          0x00406a6e
                                                          0x00000000
                                                          0x00406a6e
                                                          0x00406a3d
                                                          0x00406a40
                                                          0x00406a43
                                                          0x00406a46
                                                          0x00406a4d
                                                          0x00406991
                                                          0x00406991
                                                          0x00406994
                                                          0x00000000
                                                          0x00000000
                                                          0x00406b28
                                                          0x00406b2b
                                                          0x00000000
                                                          0x00000000
                                                          0x00406762
                                                          0x00406764
                                                          0x0040676b
                                                          0x0040676c
                                                          0x0040676e
                                                          0x00406771
                                                          0x00000000
                                                          0x00000000
                                                          0x00406779
                                                          0x0040677c
                                                          0x0040677f
                                                          0x00406781
                                                          0x00406783
                                                          0x00406783
                                                          0x00406784
                                                          0x00406787
                                                          0x0040678e
                                                          0x00406791
                                                          0x0040679f
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a75
                                                          0x00406a75
                                                          0x00406a78
                                                          0x00406a7f
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a84
                                                          0x00406a84
                                                          0x00406a88
                                                          0x00406bc0
                                                          0x00000000
                                                          0x00406bc0
                                                          0x00406a8e
                                                          0x00406a91
                                                          0x00406a94
                                                          0x00406a98
                                                          0x00406a9b
                                                          0x00406aa1
                                                          0x00406aa3
                                                          0x00406aa3
                                                          0x00406aa3
                                                          0x00406aa6
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aac
                                                          0x00406aac
                                                          0x00406ab0
                                                          0x00406b10
                                                          0x00406b13
                                                          0x00406b18
                                                          0x00406b19
                                                          0x00406b1b
                                                          0x00406b1d
                                                          0x00406b20
                                                          0x00406a2c
                                                          0x00406a2c
                                                          0x00000000
                                                          0x00406a2c
                                                          0x00406ab2
                                                          0x00406ab8
                                                          0x00406abb
                                                          0x00406abe
                                                          0x00406ac1
                                                          0x00406ac4
                                                          0x00406ac7
                                                          0x00406aca
                                                          0x00406acd
                                                          0x00406ad0
                                                          0x00406ad3
                                                          0x00406aec
                                                          0x00406aef
                                                          0x00406af2
                                                          0x00406af5
                                                          0x00406af9
                                                          0x00406afb
                                                          0x00406afb
                                                          0x00406afc
                                                          0x00406aff
                                                          0x00406ad5
                                                          0x00406ad5
                                                          0x00406add
                                                          0x00406ae2
                                                          0x00406ae4
                                                          0x00406ae7
                                                          0x00406ae7
                                                          0x00406b02
                                                          0x00406b09
                                                          0x00000000
                                                          0x00406b0b
                                                          0x00000000
                                                          0x00406b0b
                                                          0x00000000
                                                          0x004067a7
                                                          0x004067aa
                                                          0x004067e0
                                                          0x00406910
                                                          0x00406910
                                                          0x00406910
                                                          0x00406910
                                                          0x00406913
                                                          0x00406913
                                                          0x00406916
                                                          0x00406918
                                                          0x00406ba2
                                                          0x00000000
                                                          0x00406ba2
                                                          0x0040691e
                                                          0x00406921
                                                          0x00000000
                                                          0x00000000
                                                          0x00406927
                                                          0x0040692b
                                                          0x0040692e
                                                          0x0040692e
                                                          0x0040692e
                                                          0x00000000
                                                          0x0040692e
                                                          0x004067ac
                                                          0x004067ae
                                                          0x004067b0
                                                          0x004067b2
                                                          0x004067b5
                                                          0x004067b6
                                                          0x004067b8
                                                          0x004067ba
                                                          0x004067bd
                                                          0x004067c0
                                                          0x004067d6
                                                          0x004067db
                                                          0x00406813
                                                          0x00406813
                                                          0x00406817
                                                          0x00406843
                                                          0x00406845
                                                          0x0040684c
                                                          0x0040684f
                                                          0x00406852
                                                          0x00406852
                                                          0x00406857
                                                          0x00406857
                                                          0x00406859
                                                          0x0040685c
                                                          0x00406863
                                                          0x00406866
                                                          0x00406893
                                                          0x00406893
                                                          0x00406896
                                                          0x00406899
                                                          0x0040690d
                                                          0x0040690d
                                                          0x0040690d
                                                          0x00000000
                                                          0x0040690d
                                                          0x0040689b
                                                          0x004068a1
                                                          0x004068a4
                                                          0x004068a7
                                                          0x004068aa
                                                          0x004068ad
                                                          0x004068b0
                                                          0x004068b3
                                                          0x004068b6
                                                          0x004068b9
                                                          0x004068bc
                                                          0x004068d5
                                                          0x004068d7
                                                          0x004068da
                                                          0x004068db
                                                          0x004068de
                                                          0x004068e0
                                                          0x004068e3
                                                          0x004068e5
                                                          0x004068e7
                                                          0x004068ea
                                                          0x004068ec
                                                          0x004068ef
                                                          0x004068f3
                                                          0x004068f5
                                                          0x004068f5
                                                          0x004068f6
                                                          0x004068f9
                                                          0x004068fc
                                                          0x004068be
                                                          0x004068be
                                                          0x004068c6
                                                          0x004068cb
                                                          0x004068cd
                                                          0x004068d0
                                                          0x004068d0
                                                          0x004068ff
                                                          0x00406906
                                                          0x00406890
                                                          0x00406890
                                                          0x00406890
                                                          0x00406890
                                                          0x00000000
                                                          0x00406908
                                                          0x00000000
                                                          0x00406908
                                                          0x00406906
                                                          0x00406819
                                                          0x0040681c
                                                          0x0040681e
                                                          0x00406821
                                                          0x00406824
                                                          0x00406827
                                                          0x00406829
                                                          0x0040682c
                                                          0x0040682f
                                                          0x0040682f
                                                          0x00406832
                                                          0x00406832
                                                          0x00406835
                                                          0x0040683c
                                                          0x00406810
                                                          0x00406810
                                                          0x00406810
                                                          0x00406810
                                                          0x00000000
                                                          0x0040683e
                                                          0x00000000
                                                          0x0040683e
                                                          0x0040683c
                                                          0x004067c2
                                                          0x004067c5
                                                          0x004067c7
                                                          0x004067ca
                                                          0x00000000
                                                          0x00000000
                                                          0x00406529
                                                          0x00406529
                                                          0x0040652d
                                                          0x00406b72
                                                          0x00000000
                                                          0x00406b72
                                                          0x00406533
                                                          0x00406536
                                                          0x00406539
                                                          0x0040653c
                                                          0x0040653f
                                                          0x00406542
                                                          0x00406545
                                                          0x00406547
                                                          0x0040654a
                                                          0x0040654d
                                                          0x00406550
                                                          0x00406552
                                                          0x00406552
                                                          0x00406552
                                                          0x00000000
                                                          0x00000000
                                                          0x004066b4
                                                          0x004066b4
                                                          0x004066b8
                                                          0x00406b7e
                                                          0x00000000
                                                          0x00406b7e
                                                          0x004066be
                                                          0x004066c1
                                                          0x004066c4
                                                          0x004066c7
                                                          0x004066c9
                                                          0x004066c9
                                                          0x004066c9
                                                          0x004066cc
                                                          0x004066cf
                                                          0x004066d2
                                                          0x004066d5
                                                          0x004066d8
                                                          0x004066db
                                                          0x004066dc
                                                          0x004066de
                                                          0x004066de
                                                          0x004066de
                                                          0x004066e1
                                                          0x004066e4
                                                          0x004066e7
                                                          0x004066ea
                                                          0x004066ea
                                                          0x004066ea
                                                          0x004066ed
                                                          0x004066ef
                                                          0x004066ef
                                                          0x00000000
                                                          0x00000000
                                                          0x00406931
                                                          0x00406931
                                                          0x00406931
                                                          0x00406935
                                                          0x00000000
                                                          0x00000000
                                                          0x0040693b
                                                          0x0040693e
                                                          0x00406941
                                                          0x00406944
                                                          0x00406946
                                                          0x00406946
                                                          0x00406946
                                                          0x00406949
                                                          0x0040694c
                                                          0x0040694f
                                                          0x00406952
                                                          0x00406955
                                                          0x00406958
                                                          0x00406959
                                                          0x0040695b
                                                          0x0040695b
                                                          0x0040695b
                                                          0x0040695e
                                                          0x00406961
                                                          0x00406964
                                                          0x00406967
                                                          0x0040696a
                                                          0x0040696e
                                                          0x00406970
                                                          0x00406973
                                                          0x00000000
                                                          0x00406975
                                                          0x004066f2
                                                          0x004066f2
                                                          0x00000000
                                                          0x004066f2
                                                          0x00406973
                                                          0x00406ba8
                                                          0x00406bca
                                                          0x00406bd0
                                                          0x00406bd2
                                                          0x00406bd9
                                                          0x00000000
                                                          0x00000000
                                                          0x004061d7
                                                          0x00406bdf
                                                          0x00406bdf
                                                          0x00000000

                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5bfff9db2859b877ca6a77ec9405565887134ef839be144d68b3806b8d7c08ac
                                                          • Instruction ID: 4327eab70650ef0c96a691b493921a8ab8e5ba0d824f916f670fcb6a13d6a8f8
                                                          • Opcode Fuzzy Hash: 5bfff9db2859b877ca6a77ec9405565887134ef839be144d68b3806b8d7c08ac
                                                          • Instruction Fuzzy Hash: 11816671D04228DBDF24CFA8C8447ADBBB1FB44315F2181AED856BB281C7786A96DF44
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 004065E3 Relevance: 5.2, APIs: 4, Instructions: 180COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 98%
                                                          			E004065E3() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M00406BE7))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4)); // executed
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8)); // executed
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}














                                                          0x00000000
                                                          0x004065e3
                                                          0x004065e3
                                                          0x004065e7
                                                          0x00406608
                                                          0x0040660f
                                                          0x00406615
                                                          0x0040661b
                                                          0x0040662d
                                                          0x00406633
                                                          0x00406638
                                                          0x00000000
                                                          0x004065e9
                                                          0x004065ef
                                                          0x004069b0
                                                          0x004069b0
                                                          0x004069b0
                                                          0x004069b3
                                                          0x004069b3
                                                          0x004069b3
                                                          0x004069b9
                                                          0x004069bf
                                                          0x004069c5
                                                          0x004069df
                                                          0x004069e2
                                                          0x004069e8
                                                          0x004069f3
                                                          0x004069f5
                                                          0x004069c7
                                                          0x004069c7
                                                          0x004069d6
                                                          0x004069da
                                                          0x004069da
                                                          0x004069ff
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a01
                                                          0x00406a05
                                                          0x00406bb4
                                                          0x00406bca
                                                          0x00406bd2
                                                          0x00406bd9
                                                          0x00406bdb
                                                          0x00406be2
                                                          0x00406be6
                                                          0x00406be6
                                                          0x00406a11
                                                          0x00406a18
                                                          0x00406a20
                                                          0x00406a23
                                                          0x00406a26
                                                          0x00406a26
                                                          0x00406a2c
                                                          0x00406a2c
                                                          0x004061c8
                                                          0x004061c8
                                                          0x004061c8
                                                          0x004061d1
                                                          0x00000000
                                                          0x00000000
                                                          0x004061d7
                                                          0x00000000
                                                          0x004061e2
                                                          0x00000000
                                                          0x00000000
                                                          0x004061eb
                                                          0x004061ee
                                                          0x004061f1
                                                          0x004061f5
                                                          0x00000000
                                                          0x00000000
                                                          0x004061fb
                                                          0x004061fe
                                                          0x00406200
                                                          0x00406201
                                                          0x00406204
                                                          0x00406206
                                                          0x00406207
                                                          0x00406209
                                                          0x0040620c
                                                          0x00406211
                                                          0x00406216
                                                          0x0040621f
                                                          0x00406232
                                                          0x00406235
                                                          0x00406241
                                                          0x00406269
                                                          0x0040626b
                                                          0x00406279
                                                          0x00406279
                                                          0x0040627d
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040626d
                                                          0x0040626d
                                                          0x00406270
                                                          0x00406271
                                                          0x00406271
                                                          0x00000000
                                                          0x0040626d
                                                          0x00406247
                                                          0x0040624c
                                                          0x0040624c
                                                          0x00406255
                                                          0x0040625d
                                                          0x00406260
                                                          0x00000000
                                                          0x00406266
                                                          0x00406266
                                                          0x00000000
                                                          0x00406266
                                                          0x00000000
                                                          0x00406283
                                                          0x00406283
                                                          0x00406287
                                                          0x00406b33
                                                          0x00000000
                                                          0x00406b33
                                                          0x00406290
                                                          0x004062a0
                                                          0x004062a3
                                                          0x004062a6
                                                          0x004062a6
                                                          0x004062a6
                                                          0x004062a9
                                                          0x004062ad
                                                          0x00000000
                                                          0x00000000
                                                          0x004062af
                                                          0x004062b5
                                                          0x004062df
                                                          0x004062e5
                                                          0x004062ec
                                                          0x00000000
                                                          0x004062ec
                                                          0x004062bb
                                                          0x004062be
                                                          0x004062c3
                                                          0x004062c3
                                                          0x004062ce
                                                          0x004062d6
                                                          0x004062d9
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040631e
                                                          0x00406324
                                                          0x00406327
                                                          0x00406334
                                                          0x0040633c
                                                          0x00000000
                                                          0x00000000
                                                          0x004062f3
                                                          0x004062f3
                                                          0x004062f7
                                                          0x00406b42
                                                          0x00000000
                                                          0x00406b42
                                                          0x00406303
                                                          0x0040630e
                                                          0x0040630e
                                                          0x0040630e
                                                          0x00406311
                                                          0x00406314
                                                          0x00406317
                                                          0x0040631c
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x004069b3
                                                          0x004069b3
                                                          0x004069b9
                                                          0x004069bf
                                                          0x004069c5
                                                          0x004069df
                                                          0x004069e2
                                                          0x004069e8
                                                          0x004069f3
                                                          0x004069f5
                                                          0x004069c7
                                                          0x004069c7
                                                          0x004069d6
                                                          0x004069da
                                                          0x004069da
                                                          0x004069ff
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00406344
                                                          0x00406346
                                                          0x00406349
                                                          0x004063ba
                                                          0x004063bd
                                                          0x004063c0
                                                          0x004063c7
                                                          0x004063d1
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00000000
                                                          0x004069b0
                                                          0x0040634b
                                                          0x0040634f
                                                          0x00406352
                                                          0x00406354
                                                          0x00406357
                                                          0x0040635a
                                                          0x0040635c
                                                          0x0040635f
                                                          0x00406361
                                                          0x00406366
                                                          0x00406369
                                                          0x0040636c
                                                          0x00406370
                                                          0x00406377
                                                          0x0040637a
                                                          0x00406381
                                                          0x00406385
                                                          0x0040638d
                                                          0x0040638d
                                                          0x0040638d
                                                          0x00406387
                                                          0x00406387
                                                          0x00406387
                                                          0x0040637c
                                                          0x0040637c
                                                          0x0040637c
                                                          0x00406391
                                                          0x00406394
                                                          0x004063b2
                                                          0x004063b4
                                                          0x00000000
                                                          0x00406396
                                                          0x00406396
                                                          0x00406399
                                                          0x0040639c
                                                          0x0040639f
                                                          0x004063a1
                                                          0x004063a1
                                                          0x004063a1
                                                          0x004063a4
                                                          0x004063a7
                                                          0x004063a9
                                                          0x004063aa
                                                          0x004063ad
                                                          0x00000000
                                                          0x004063ad
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040664d
                                                          0x00406651
                                                          0x00406674
                                                          0x00406677
                                                          0x0040667a
                                                          0x00406684
                                                          0x00406653
                                                          0x00406653
                                                          0x00406656
                                                          0x00406659
                                                          0x0040665c
                                                          0x00406669
                                                          0x0040666c
                                                          0x0040666c
                                                          0x004069b0
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00000000
                                                          0x004069b0
                                                          0x00000000
                                                          0x00406690
                                                          0x00406694
                                                          0x00000000
                                                          0x00000000
                                                          0x0040669a
                                                          0x0040669e
                                                          0x00000000
                                                          0x00000000
                                                          0x004066a4
                                                          0x004066a6
                                                          0x004066aa
                                                          0x004066aa
                                                          0x004066ad
                                                          0x004066b1
                                                          0x00000000
                                                          0x00000000
                                                          0x00406701
                                                          0x00406705
                                                          0x0040670c
                                                          0x0040670f
                                                          0x00406712
                                                          0x0040671c
                                                          0x004069b0
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00000000
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00406707
                                                          0x00000000
                                                          0x00000000
                                                          0x00406728
                                                          0x0040672c
                                                          0x00406733
                                                          0x00406736
                                                          0x00406739
                                                          0x0040672e
                                                          0x0040672e
                                                          0x0040672e
                                                          0x0040673c
                                                          0x0040673f
                                                          0x00406742
                                                          0x00406742
                                                          0x00406745
                                                          0x00406748
                                                          0x0040674b
                                                          0x0040674b
                                                          0x0040674e
                                                          0x00406755
                                                          0x0040675a
                                                          0x00000000
                                                          0x00000000
                                                          0x004067e8
                                                          0x004067e8
                                                          0x004067ec
                                                          0x00406b8a
                                                          0x00000000
                                                          0x00406b8a
                                                          0x004067f2
                                                          0x004067f5
                                                          0x004067f8
                                                          0x004067fc
                                                          0x004067ff
                                                          0x00406805
                                                          0x00406807
                                                          0x00406807
                                                          0x00406807
                                                          0x0040680a
                                                          0x0040680d
                                                          0x00000000
                                                          0x00000000
                                                          0x004063dd
                                                          0x004063dd
                                                          0x004063e1
                                                          0x00406b4e
                                                          0x00000000
                                                          0x00406b4e
                                                          0x004063e7
                                                          0x004063ea
                                                          0x004063ed
                                                          0x004063f1
                                                          0x004063f4
                                                          0x004063fa
                                                          0x004063fc
                                                          0x004063fc
                                                          0x004063fc
                                                          0x004063ff
                                                          0x00406402
                                                          0x00406402
                                                          0x00406405
                                                          0x00406408
                                                          0x00000000
                                                          0x00000000
                                                          0x0040640e
                                                          0x00406414
                                                          0x00000000
                                                          0x00000000
                                                          0x0040641a
                                                          0x0040641a
                                                          0x0040641e
                                                          0x00406421
                                                          0x00406424
                                                          0x00406427
                                                          0x0040642a
                                                          0x0040642b
                                                          0x0040642e
                                                          0x00406430
                                                          0x00406436
                                                          0x00406439
                                                          0x0040643c
                                                          0x0040643f
                                                          0x00406442
                                                          0x00406445
                                                          0x00406448
                                                          0x00406464
                                                          0x00406467
                                                          0x0040646a
                                                          0x0040646d
                                                          0x00406474
                                                          0x00406478
                                                          0x0040647a
                                                          0x0040647e
                                                          0x0040644a
                                                          0x0040644a
                                                          0x0040644e
                                                          0x00406456
                                                          0x0040645b
                                                          0x0040645d
                                                          0x0040645f
                                                          0x0040645f
                                                          0x00406481
                                                          0x00406488
                                                          0x0040648b
                                                          0x00000000
                                                          0x00406491
                                                          0x00000000
                                                          0x00406491
                                                          0x00000000
                                                          0x00406496
                                                          0x00406496
                                                          0x0040649a
                                                          0x00406b5a
                                                          0x00000000
                                                          0x00406b5a
                                                          0x004064a0
                                                          0x004064a3
                                                          0x004064a6
                                                          0x004064aa
                                                          0x004064ad
                                                          0x004064b3
                                                          0x004064b5
                                                          0x004064b5
                                                          0x004064b5
                                                          0x004064b8
                                                          0x004064bb
                                                          0x004064bb
                                                          0x004064bb
                                                          0x004064c1
                                                          0x00000000
                                                          0x00000000
                                                          0x004064c3
                                                          0x004064c6
                                                          0x004064c9
                                                          0x004064cc
                                                          0x004064cf
                                                          0x004064d2
                                                          0x004064d5
                                                          0x004064d8
                                                          0x004064db
                                                          0x004064de
                                                          0x004064e1
                                                          0x004064f9
                                                          0x004064fc
                                                          0x004064ff
                                                          0x00406502
                                                          0x00406502
                                                          0x00406505
                                                          0x00406509
                                                          0x0040650b
                                                          0x004064e3
                                                          0x004064e3
                                                          0x004064eb
                                                          0x004064f0
                                                          0x004064f2
                                                          0x004064f4
                                                          0x004064f4
                                                          0x0040650e
                                                          0x00406515
                                                          0x00406518
                                                          0x00000000
                                                          0x0040651a
                                                          0x00000000
                                                          0x0040651a
                                                          0x00406518
                                                          0x0040651f
                                                          0x0040651f
                                                          0x0040651f
                                                          0x0040651f
                                                          0x00000000
                                                          0x00000000
                                                          0x0040655a
                                                          0x0040655a
                                                          0x0040655e
                                                          0x00406b66
                                                          0x00000000
                                                          0x00406b66
                                                          0x00406564
                                                          0x00406567
                                                          0x0040656a
                                                          0x0040656e
                                                          0x00406571
                                                          0x00406577
                                                          0x00406579
                                                          0x00406579
                                                          0x00406579
                                                          0x0040657c
                                                          0x0040657f
                                                          0x0040657f
                                                          0x00406585
                                                          0x00406523
                                                          0x00406523
                                                          0x00406526
                                                          0x00000000
                                                          0x00406526
                                                          0x00406587
                                                          0x00406587
                                                          0x0040658a
                                                          0x0040658d
                                                          0x00406590
                                                          0x00406593
                                                          0x00406596
                                                          0x00406599
                                                          0x0040659c
                                                          0x0040659f
                                                          0x004065a2
                                                          0x004065a5
                                                          0x004065bd
                                                          0x004065c0
                                                          0x004065c3
                                                          0x004065c6
                                                          0x004065c6
                                                          0x004065c9
                                                          0x004065cd
                                                          0x004065cf
                                                          0x004065a7
                                                          0x004065a7
                                                          0x004065af
                                                          0x004065b4
                                                          0x004065b6
                                                          0x004065b8
                                                          0x004065b8
                                                          0x004065d2
                                                          0x004065d9
                                                          0x004065dc
                                                          0x00000000
                                                          0x004065de
                                                          0x00000000
                                                          0x004065de
                                                          0x00000000
                                                          0x0040686b
                                                          0x0040686b
                                                          0x0040686f
                                                          0x00406b96
                                                          0x00000000
                                                          0x00406b96
                                                          0x00406875
                                                          0x00406878
                                                          0x0040687b
                                                          0x0040687f
                                                          0x00406882
                                                          0x00406888
                                                          0x0040688a
                                                          0x0040688a
                                                          0x0040688a
                                                          0x0040688d
                                                          0x00000000
                                                          0x00000000
                                                          0x0040663b
                                                          0x0040663b
                                                          0x0040663e
                                                          0x004069b0
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00000000
                                                          0x004069b0
                                                          0x00000000
                                                          0x0040697a
                                                          0x0040697e
                                                          0x004069a0
                                                          0x004069a3
                                                          0x004069ad
                                                          0x004069b0
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00000000
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00406980
                                                          0x00406983
                                                          0x00406987
                                                          0x0040698a
                                                          0x0040698a
                                                          0x0040698d
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a37
                                                          0x00406a3b
                                                          0x00406a59
                                                          0x00406a59
                                                          0x00406a59
                                                          0x00406a60
                                                          0x00406a67
                                                          0x00406a6e
                                                          0x00406a6e
                                                          0x00000000
                                                          0x00406a6e
                                                          0x00406a3d
                                                          0x00406a40
                                                          0x00406a43
                                                          0x00406a46
                                                          0x00406a4d
                                                          0x00406991
                                                          0x00406991
                                                          0x00406994
                                                          0x00000000
                                                          0x00000000
                                                          0x00406b28
                                                          0x00406b2b
                                                          0x00406a2c
                                                          0x00000000
                                                          0x00000000
                                                          0x00406762
                                                          0x00406764
                                                          0x0040676b
                                                          0x0040676c
                                                          0x0040676e
                                                          0x00406771
                                                          0x00000000
                                                          0x00000000
                                                          0x00406779
                                                          0x0040677c
                                                          0x0040677f
                                                          0x00406781
                                                          0x00406783
                                                          0x00406783
                                                          0x00406784
                                                          0x00406787
                                                          0x0040678e
                                                          0x00406791
                                                          0x0040679f
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a75
                                                          0x00406a75
                                                          0x00406a78
                                                          0x00406a7f
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a84
                                                          0x00406a84
                                                          0x00406a88
                                                          0x00406bc0
                                                          0x00000000
                                                          0x00406bc0
                                                          0x00406a8e
                                                          0x00406a91
                                                          0x00406a94
                                                          0x00406a98
                                                          0x00406a9b
                                                          0x00406aa1
                                                          0x00406aa3
                                                          0x00406aa3
                                                          0x00406aa3
                                                          0x00406aa6
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aac
                                                          0x00406aac
                                                          0x00406ab0
                                                          0x00406b10
                                                          0x00406b13
                                                          0x00406b18
                                                          0x00406b19
                                                          0x00406b1b
                                                          0x00406b1d
                                                          0x00406b20
                                                          0x00406a2c
                                                          0x00406a2c
                                                          0x00000000
                                                          0x00406a32
                                                          0x00406a2c
                                                          0x00406ab2
                                                          0x00406ab8
                                                          0x00406abb
                                                          0x00406abe
                                                          0x00406ac1
                                                          0x00406ac4
                                                          0x00406ac7
                                                          0x00406aca
                                                          0x00406acd
                                                          0x00406ad0
                                                          0x00406ad3
                                                          0x00406aec
                                                          0x00406aef
                                                          0x00406af2
                                                          0x00406af5
                                                          0x00406af9
                                                          0x00406afb
                                                          0x00406afb
                                                          0x00406afc
                                                          0x00406aff
                                                          0x00406ad5
                                                          0x00406ad5
                                                          0x00406add
                                                          0x00406ae2
                                                          0x00406ae4
                                                          0x00406ae7
                                                          0x00406ae7
                                                          0x00406b02
                                                          0x00406b09
                                                          0x00000000
                                                          0x00406b0b
                                                          0x00000000
                                                          0x00406b0b
                                                          0x00000000
                                                          0x004067a7
                                                          0x004067aa
                                                          0x004067e0
                                                          0x00406910
                                                          0x00406910
                                                          0x00406910
                                                          0x00406910
                                                          0x00406913
                                                          0x00406913
                                                          0x00406916
                                                          0x00406918
                                                          0x00406ba2
                                                          0x00000000
                                                          0x00406ba2
                                                          0x0040691e
                                                          0x00406921
                                                          0x00000000
                                                          0x00000000
                                                          0x00406927
                                                          0x0040692b
                                                          0x0040692e
                                                          0x0040692e
                                                          0x0040692e
                                                          0x00000000
                                                          0x0040692e
                                                          0x004067ac
                                                          0x004067ae
                                                          0x004067b0
                                                          0x004067b2
                                                          0x004067b5
                                                          0x004067b6
                                                          0x004067b8
                                                          0x004067ba
                                                          0x004067bd
                                                          0x004067c0
                                                          0x004067d6
                                                          0x004067db
                                                          0x00406813
                                                          0x00406813
                                                          0x00406817
                                                          0x00406843
                                                          0x00406845
                                                          0x0040684c
                                                          0x0040684f
                                                          0x00406852
                                                          0x00406852
                                                          0x00406857
                                                          0x00406857
                                                          0x00406859
                                                          0x0040685c
                                                          0x00406863
                                                          0x00406866
                                                          0x00406893
                                                          0x00406893
                                                          0x00406896
                                                          0x00406899
                                                          0x0040690d
                                                          0x0040690d
                                                          0x0040690d
                                                          0x00000000
                                                          0x0040690d
                                                          0x0040689b
                                                          0x004068a1
                                                          0x004068a4
                                                          0x004068a7
                                                          0x004068aa
                                                          0x004068ad
                                                          0x004068b0
                                                          0x004068b3
                                                          0x004068b6
                                                          0x004068b9
                                                          0x004068bc
                                                          0x004068d5
                                                          0x004068d7
                                                          0x004068da
                                                          0x004068db
                                                          0x004068de
                                                          0x004068e0
                                                          0x004068e3
                                                          0x004068e5
                                                          0x004068e7
                                                          0x004068ea
                                                          0x004068ec
                                                          0x004068ef
                                                          0x004068f3
                                                          0x004068f5
                                                          0x004068f5
                                                          0x004068f6
                                                          0x004068f9
                                                          0x004068fc
                                                          0x004068be
                                                          0x004068be
                                                          0x004068c6
                                                          0x004068cb
                                                          0x004068cd
                                                          0x004068d0
                                                          0x004068d0
                                                          0x004068ff
                                                          0x00406906
                                                          0x00406890
                                                          0x00406890
                                                          0x00406890
                                                          0x00406890
                                                          0x00000000
                                                          0x00406908
                                                          0x00000000
                                                          0x00406908
                                                          0x00406906
                                                          0x00406819
                                                          0x0040681c
                                                          0x0040681e
                                                          0x00406821
                                                          0x00406824
                                                          0x00406827
                                                          0x00406829
                                                          0x0040682c
                                                          0x0040682f
                                                          0x0040682f
                                                          0x00406832
                                                          0x00406832
                                                          0x00406835
                                                          0x0040683c
                                                          0x00406810
                                                          0x00406810
                                                          0x00406810
                                                          0x00406810
                                                          0x00000000
                                                          0x0040683e
                                                          0x00000000
                                                          0x0040683e
                                                          0x0040683c
                                                          0x004067c2
                                                          0x004067c5
                                                          0x004067c7
                                                          0x004067ca
                                                          0x00000000
                                                          0x00000000
                                                          0x00406529
                                                          0x00406529
                                                          0x0040652d
                                                          0x00406b72
                                                          0x00000000
                                                          0x00406b72
                                                          0x00406533
                                                          0x00406536
                                                          0x00406539
                                                          0x0040653c
                                                          0x0040653f
                                                          0x00406542
                                                          0x00406545
                                                          0x00406547
                                                          0x0040654a
                                                          0x0040654d
                                                          0x00406550
                                                          0x00406552
                                                          0x00406552
                                                          0x00406552
                                                          0x00000000
                                                          0x00000000
                                                          0x004066b4
                                                          0x004066b4
                                                          0x004066b8
                                                          0x00406b7e
                                                          0x00000000
                                                          0x00406b7e
                                                          0x004066be
                                                          0x004066c1
                                                          0x004066c4
                                                          0x004066c7
                                                          0x004066c9
                                                          0x004066c9
                                                          0x004066c9
                                                          0x004066cc
                                                          0x004066cf
                                                          0x004066d2
                                                          0x004066d5
                                                          0x004066d8
                                                          0x004066db
                                                          0x004066dc
                                                          0x004066de
                                                          0x004066de
                                                          0x004066de
                                                          0x004066e1
                                                          0x004066e4
                                                          0x004066e7
                                                          0x004066ea
                                                          0x004066ea
                                                          0x004066ea
                                                          0x004066ed
                                                          0x004066ef
                                                          0x004066ef
                                                          0x00000000
                                                          0x00000000
                                                          0x00406931
                                                          0x00406931
                                                          0x00406931
                                                          0x00406935
                                                          0x00000000
                                                          0x00000000
                                                          0x0040693b
                                                          0x0040693e
                                                          0x00406941
                                                          0x00406944
                                                          0x00406946
                                                          0x00406946
                                                          0x00406946
                                                          0x00406949
                                                          0x0040694c
                                                          0x0040694f
                                                          0x00406952
                                                          0x00406955
                                                          0x00406958
                                                          0x00406959
                                                          0x0040695b
                                                          0x0040695b
                                                          0x0040695b
                                                          0x0040695e
                                                          0x00406961
                                                          0x00406964
                                                          0x00406967
                                                          0x0040696a
                                                          0x0040696e
                                                          0x00406970
                                                          0x00406973
                                                          0x00000000
                                                          0x00406975
                                                          0x004066f2
                                                          0x004066f2
                                                          0x00000000
                                                          0x004066f2
                                                          0x00406973
                                                          0x00406ba8
                                                          0x00000000
                                                          0x00000000
                                                          0x004061d7
                                                          0x00406bdf
                                                          0x00406bdf
                                                          0x00000000
                                                          0x00406bdf
                                                          0x00406a2c
                                                          0x004069b3
                                                          0x004069b0
                                                          0x00000000
                                                          0x004065e7

                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2f3dabd0af62f4e8bfcd4b659d73a5ba33a7939e144f292b7bb16ba2439e66e8
                                                          • Instruction ID: 63ee65aff5d1ea53a99bb7455827a561e54e570c364fe5978cc4b9ff32097947
                                                          • Opcode Fuzzy Hash: 2f3dabd0af62f4e8bfcd4b659d73a5ba33a7939e144f292b7bb16ba2439e66e8
                                                          • Instruction Fuzzy Hash: E9711271D04228CBDF24CFA8C8547ADBBF1FB48305F15806AD856BB281D7786A96DF44
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00406701 Relevance: 5.2, APIs: 4, Instructions: 170COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 98%
                                                          			E00406701() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M00406BE7))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4)); // executed
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8)); // executed
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}













                                                          0x00000000
                                                          0x00406701
                                                          0x00406701
                                                          0x00406705
                                                          0x00406712
                                                          0x0040671c
                                                          0x00000000
                                                          0x00406707
                                                          0x00406707
                                                          0x00406742
                                                          0x00406745
                                                          0x00406748
                                                          0x0040674b
                                                          0x0040674b
                                                          0x0040674e
                                                          0x00406755
                                                          0x0040675a
                                                          0x0040663b
                                                          0x0040663e
                                                          0x004069b0
                                                          0x004069b0
                                                          0x004069b0
                                                          0x004069b3
                                                          0x004069b3
                                                          0x004069b3
                                                          0x004069b9
                                                          0x004069bf
                                                          0x004069c5
                                                          0x004069df
                                                          0x004069e2
                                                          0x004069e8
                                                          0x004069f3
                                                          0x004069f5
                                                          0x004069c7
                                                          0x004069c7
                                                          0x004069d6
                                                          0x004069da
                                                          0x004069da
                                                          0x004069ff
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a01
                                                          0x00406a05
                                                          0x00406bb4
                                                          0x00406bca
                                                          0x00406bd2
                                                          0x00406bd9
                                                          0x00406bdb
                                                          0x00406be2
                                                          0x00406be6
                                                          0x00406be6
                                                          0x00406a11
                                                          0x00406a18
                                                          0x00406a20
                                                          0x00406a23
                                                          0x00406a26
                                                          0x00406a26
                                                          0x00406a2c
                                                          0x00406a2c
                                                          0x004061c8
                                                          0x004061c8
                                                          0x004061c8
                                                          0x004061d1
                                                          0x00000000
                                                          0x00000000
                                                          0x004061d7
                                                          0x00000000
                                                          0x004061e2
                                                          0x00000000
                                                          0x00000000
                                                          0x004061eb
                                                          0x004061ee
                                                          0x004061f1
                                                          0x004061f5
                                                          0x00000000
                                                          0x00000000
                                                          0x004061fb
                                                          0x004061fe
                                                          0x00406200
                                                          0x00406201
                                                          0x00406204
                                                          0x00406206
                                                          0x00406207
                                                          0x00406209
                                                          0x0040620c
                                                          0x00406211
                                                          0x00406216
                                                          0x0040621f
                                                          0x00406232
                                                          0x00406235
                                                          0x00406241
                                                          0x00406269
                                                          0x0040626b
                                                          0x00406279
                                                          0x00406279
                                                          0x0040627d
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040626d
                                                          0x0040626d
                                                          0x00406270
                                                          0x00406271
                                                          0x00406271
                                                          0x00000000
                                                          0x0040626d
                                                          0x00406247
                                                          0x0040624c
                                                          0x0040624c
                                                          0x00406255
                                                          0x0040625d
                                                          0x00406260
                                                          0x00000000
                                                          0x00406266
                                                          0x00406266
                                                          0x00000000
                                                          0x00406266
                                                          0x00000000
                                                          0x00406283
                                                          0x00406283
                                                          0x00406287
                                                          0x00406b33
                                                          0x00000000
                                                          0x00406b33
                                                          0x00406290
                                                          0x004062a0
                                                          0x004062a3
                                                          0x004062a6
                                                          0x004062a6
                                                          0x004062a6
                                                          0x004062a9
                                                          0x004062ad
                                                          0x00000000
                                                          0x00000000
                                                          0x004062af
                                                          0x004062b5
                                                          0x004062df
                                                          0x004062e5
                                                          0x004062ec
                                                          0x00000000
                                                          0x004062ec
                                                          0x004062bb
                                                          0x004062be
                                                          0x004062c3
                                                          0x004062c3
                                                          0x004062ce
                                                          0x004062d6
                                                          0x004062d9
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040631e
                                                          0x00406324
                                                          0x00406327
                                                          0x00406334
                                                          0x0040633c
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00000000
                                                          0x00000000
                                                          0x004062f3
                                                          0x004062f3
                                                          0x004062f7
                                                          0x00406b42
                                                          0x00000000
                                                          0x00406b42
                                                          0x00406303
                                                          0x0040630e
                                                          0x0040630e
                                                          0x0040630e
                                                          0x00406311
                                                          0x00406314
                                                          0x00406317
                                                          0x0040631c
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x004069b3
                                                          0x004069b3
                                                          0x004069b9
                                                          0x004069bf
                                                          0x004069c5
                                                          0x004069df
                                                          0x004069e2
                                                          0x004069e8
                                                          0x004069f3
                                                          0x004069f5
                                                          0x004069c7
                                                          0x004069c7
                                                          0x004069d6
                                                          0x004069da
                                                          0x004069da
                                                          0x004069ff
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00406344
                                                          0x00406346
                                                          0x00406349
                                                          0x004063ba
                                                          0x004063bd
                                                          0x004063c0
                                                          0x004063c7
                                                          0x004063d1
                                                          0x004069b0
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00000000
                                                          0x004069b0
                                                          0x004069b0
                                                          0x0040634b
                                                          0x0040634f
                                                          0x00406352
                                                          0x00406354
                                                          0x00406357
                                                          0x0040635a
                                                          0x0040635c
                                                          0x0040635f
                                                          0x00406361
                                                          0x00406366
                                                          0x00406369
                                                          0x0040636c
                                                          0x00406370
                                                          0x00406377
                                                          0x0040637a
                                                          0x00406381
                                                          0x00406385
                                                          0x0040638d
                                                          0x0040638d
                                                          0x0040638d
                                                          0x00406387
                                                          0x00406387
                                                          0x00406387
                                                          0x0040637c
                                                          0x0040637c
                                                          0x0040637c
                                                          0x00406391
                                                          0x00406394
                                                          0x004063b2
                                                          0x004063b4
                                                          0x00000000
                                                          0x00406396
                                                          0x00406396
                                                          0x00406399
                                                          0x0040639c
                                                          0x0040639f
                                                          0x004063a1
                                                          0x004063a1
                                                          0x004063a1
                                                          0x004063a4
                                                          0x004063a7
                                                          0x004063a9
                                                          0x004063aa
                                                          0x004063ad
                                                          0x00000000
                                                          0x004063ad
                                                          0x00000000
                                                          0x004065e3
                                                          0x004065e7
                                                          0x00406605
                                                          0x00406608
                                                          0x0040660f
                                                          0x00406612
                                                          0x00406615
                                                          0x00406618
                                                          0x0040661b
                                                          0x0040661e
                                                          0x00406620
                                                          0x00406627
                                                          0x00406628
                                                          0x0040662a
                                                          0x0040662d
                                                          0x00406630
                                                          0x00406633
                                                          0x00406633
                                                          0x00406638
                                                          0x00000000
                                                          0x00406638
                                                          0x004065e9
                                                          0x004065ec
                                                          0x004065ef
                                                          0x004065f9
                                                          0x004069b0
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00000000
                                                          0x004069b0
                                                          0x00000000
                                                          0x0040664d
                                                          0x00406651
                                                          0x00406674
                                                          0x00406677
                                                          0x0040667a
                                                          0x00406684
                                                          0x00406653
                                                          0x00406653
                                                          0x00406656
                                                          0x00406659
                                                          0x0040665c
                                                          0x00406669
                                                          0x0040666c
                                                          0x0040666c
                                                          0x004069b0
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00000000
                                                          0x004069b0
                                                          0x00000000
                                                          0x00406690
                                                          0x00406694
                                                          0x00000000
                                                          0x00000000
                                                          0x0040669a
                                                          0x0040669e
                                                          0x00000000
                                                          0x00000000
                                                          0x004066a4
                                                          0x004066a6
                                                          0x004066aa
                                                          0x004066aa
                                                          0x004066ad
                                                          0x004066b1
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00406728
                                                          0x0040672c
                                                          0x00406733
                                                          0x00406736
                                                          0x00406739
                                                          0x0040672e
                                                          0x0040672e
                                                          0x0040672e
                                                          0x0040673c
                                                          0x0040673f
                                                          0x00000000
                                                          0x00000000
                                                          0x004067e8
                                                          0x004067e8
                                                          0x004067ec
                                                          0x00406b8a
                                                          0x00000000
                                                          0x00406b8a
                                                          0x004067f2
                                                          0x004067f5
                                                          0x004067f8
                                                          0x004067fc
                                                          0x004067ff
                                                          0x00406805
                                                          0x00406807
                                                          0x00406807
                                                          0x00406807
                                                          0x0040680a
                                                          0x0040680d
                                                          0x00000000
                                                          0x00000000
                                                          0x004063dd
                                                          0x004063dd
                                                          0x004063e1
                                                          0x00406b4e
                                                          0x00000000
                                                          0x00406b4e
                                                          0x004063e7
                                                          0x004063ea
                                                          0x004063ed
                                                          0x004063f1
                                                          0x004063f4
                                                          0x004063fa
                                                          0x004063fc
                                                          0x004063fc
                                                          0x004063fc
                                                          0x004063ff
                                                          0x00406402
                                                          0x00406402
                                                          0x00406405
                                                          0x00406408
                                                          0x00000000
                                                          0x00000000
                                                          0x0040640e
                                                          0x00406414
                                                          0x00000000
                                                          0x00000000
                                                          0x0040641a
                                                          0x0040641a
                                                          0x0040641e
                                                          0x00406421
                                                          0x00406424
                                                          0x00406427
                                                          0x0040642a
                                                          0x0040642b
                                                          0x0040642e
                                                          0x00406430
                                                          0x00406436
                                                          0x00406439
                                                          0x0040643c
                                                          0x0040643f
                                                          0x00406442
                                                          0x00406445
                                                          0x00406448
                                                          0x00406464
                                                          0x00406467
                                                          0x0040646a
                                                          0x0040646d
                                                          0x00406474
                                                          0x00406478
                                                          0x0040647a
                                                          0x0040647e
                                                          0x0040644a
                                                          0x0040644a
                                                          0x0040644e
                                                          0x00406456
                                                          0x0040645b
                                                          0x0040645d
                                                          0x0040645f
                                                          0x0040645f
                                                          0x00406481
                                                          0x00406488
                                                          0x0040648b
                                                          0x00000000
                                                          0x00406491
                                                          0x00000000
                                                          0x00406491
                                                          0x00000000
                                                          0x00406496
                                                          0x00406496
                                                          0x0040649a
                                                          0x00406b5a
                                                          0x00000000
                                                          0x00406b5a
                                                          0x004064a0
                                                          0x004064a3
                                                          0x004064a6
                                                          0x004064aa
                                                          0x004064ad
                                                          0x004064b3
                                                          0x004064b5
                                                          0x004064b5
                                                          0x004064b5
                                                          0x004064b8
                                                          0x004064bb
                                                          0x004064bb
                                                          0x004064bb
                                                          0x004064c1
                                                          0x00000000
                                                          0x00000000
                                                          0x004064c3
                                                          0x004064c6
                                                          0x004064c9
                                                          0x004064cc
                                                          0x004064cf
                                                          0x004064d2
                                                          0x004064d5
                                                          0x004064d8
                                                          0x004064db
                                                          0x004064de
                                                          0x004064e1
                                                          0x004064f9
                                                          0x004064fc
                                                          0x004064ff
                                                          0x00406502
                                                          0x00406502
                                                          0x00406505
                                                          0x00406509
                                                          0x0040650b
                                                          0x004064e3
                                                          0x004064e3
                                                          0x004064eb
                                                          0x004064f0
                                                          0x004064f2
                                                          0x004064f4
                                                          0x004064f4
                                                          0x0040650e
                                                          0x00406515
                                                          0x00406518
                                                          0x00000000
                                                          0x0040651a
                                                          0x00000000
                                                          0x0040651a
                                                          0x00406518
                                                          0x0040651f
                                                          0x0040651f
                                                          0x0040651f
                                                          0x0040651f
                                                          0x00000000
                                                          0x00000000
                                                          0x0040655a
                                                          0x0040655a
                                                          0x0040655e
                                                          0x00406b66
                                                          0x00000000
                                                          0x00406b66
                                                          0x00406564
                                                          0x00406567
                                                          0x0040656a
                                                          0x0040656e
                                                          0x00406571
                                                          0x00406577
                                                          0x00406579
                                                          0x00406579
                                                          0x00406579
                                                          0x0040657c
                                                          0x0040657f
                                                          0x0040657f
                                                          0x00406585
                                                          0x00406523
                                                          0x00406523
                                                          0x00406526
                                                          0x00000000
                                                          0x00406526
                                                          0x00406587
                                                          0x00406587
                                                          0x0040658a
                                                          0x0040658d
                                                          0x00406590
                                                          0x00406593
                                                          0x00406596
                                                          0x00406599
                                                          0x0040659c
                                                          0x0040659f
                                                          0x004065a2
                                                          0x004065a5
                                                          0x004065bd
                                                          0x004065c0
                                                          0x004065c3
                                                          0x004065c6
                                                          0x004065c6
                                                          0x004065c9
                                                          0x004065cd
                                                          0x004065cf
                                                          0x004065a7
                                                          0x004065a7
                                                          0x004065af
                                                          0x004065b4
                                                          0x004065b6
                                                          0x004065b8
                                                          0x004065b8
                                                          0x004065d2
                                                          0x004065d9
                                                          0x004065dc
                                                          0x00000000
                                                          0x004065de
                                                          0x00000000
                                                          0x004065de
                                                          0x00000000
                                                          0x0040686b
                                                          0x0040686b
                                                          0x0040686f
                                                          0x00406b96
                                                          0x00000000
                                                          0x00406b96
                                                          0x00406875
                                                          0x00406878
                                                          0x0040687b
                                                          0x0040687f
                                                          0x00406882
                                                          0x00406888
                                                          0x0040688a
                                                          0x0040688a
                                                          0x0040688a
                                                          0x0040688d
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040697a
                                                          0x0040697e
                                                          0x004069a0
                                                          0x004069a3
                                                          0x004069ad
                                                          0x004069b0
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00000000
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00406980
                                                          0x00406983
                                                          0x00406987
                                                          0x0040698a
                                                          0x0040698a
                                                          0x0040698d
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a37
                                                          0x00406a3b
                                                          0x00406a59
                                                          0x00406a59
                                                          0x00406a59
                                                          0x00406a60
                                                          0x00406a67
                                                          0x00406a6e
                                                          0x00406a6e
                                                          0x00000000
                                                          0x00406a6e
                                                          0x00406a3d
                                                          0x00406a40
                                                          0x00406a43
                                                          0x00406a46
                                                          0x00406a4d
                                                          0x00406991
                                                          0x00406991
                                                          0x00406994
                                                          0x00000000
                                                          0x00000000
                                                          0x00406b28
                                                          0x00406b2b
                                                          0x00406a2c
                                                          0x00000000
                                                          0x00000000
                                                          0x00406762
                                                          0x00406764
                                                          0x0040676b
                                                          0x0040676c
                                                          0x0040676e
                                                          0x00406771
                                                          0x00000000
                                                          0x00000000
                                                          0x00406779
                                                          0x0040677c
                                                          0x0040677f
                                                          0x00406781
                                                          0x00406783
                                                          0x00406783
                                                          0x00406784
                                                          0x00406787
                                                          0x0040678e
                                                          0x00406791
                                                          0x0040679f
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a75
                                                          0x00406a75
                                                          0x00406a78
                                                          0x00406a7f
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a84
                                                          0x00406a84
                                                          0x00406a88
                                                          0x00406bc0
                                                          0x00000000
                                                          0x00406bc0
                                                          0x00406a8e
                                                          0x00406a91
                                                          0x00406a94
                                                          0x00406a98
                                                          0x00406a9b
                                                          0x00406aa1
                                                          0x00406aa3
                                                          0x00406aa3
                                                          0x00406aa3
                                                          0x00406aa6
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aac
                                                          0x00406aac
                                                          0x00406ab0
                                                          0x00406b10
                                                          0x00406b13
                                                          0x00406b18
                                                          0x00406b19
                                                          0x00406b1b
                                                          0x00406b1d
                                                          0x00406b20
                                                          0x00406a2c
                                                          0x00406a2c
                                                          0x00000000
                                                          0x00406a32
                                                          0x00406a2c
                                                          0x00406ab2
                                                          0x00406ab8
                                                          0x00406abb
                                                          0x00406abe
                                                          0x00406ac1
                                                          0x00406ac4
                                                          0x00406ac7
                                                          0x00406aca
                                                          0x00406acd
                                                          0x00406ad0
                                                          0x00406ad3
                                                          0x00406aec
                                                          0x00406aef
                                                          0x00406af2
                                                          0x00406af5
                                                          0x00406af9
                                                          0x00406afb
                                                          0x00406afb
                                                          0x00406afc
                                                          0x00406aff
                                                          0x00406ad5
                                                          0x00406ad5
                                                          0x00406add
                                                          0x00406ae2
                                                          0x00406ae4
                                                          0x00406ae7
                                                          0x00406ae7
                                                          0x00406b02
                                                          0x00406b09
                                                          0x00000000
                                                          0x00406b0b
                                                          0x00000000
                                                          0x00406b0b
                                                          0x00000000
                                                          0x004067a7
                                                          0x004067aa
                                                          0x004067e0
                                                          0x00406910
                                                          0x00406910
                                                          0x00406910
                                                          0x00406910
                                                          0x00406913
                                                          0x00406913
                                                          0x00406916
                                                          0x00406918
                                                          0x00406ba2
                                                          0x00000000
                                                          0x00406ba2
                                                          0x0040691e
                                                          0x00406921
                                                          0x00000000
                                                          0x00000000
                                                          0x00406927
                                                          0x0040692b
                                                          0x0040692e
                                                          0x0040692e
                                                          0x0040692e
                                                          0x00000000
                                                          0x0040692e
                                                          0x004067ac
                                                          0x004067ae
                                                          0x004067b0
                                                          0x004067b2
                                                          0x004067b5
                                                          0x004067b6
                                                          0x004067b8
                                                          0x004067ba
                                                          0x004067bd
                                                          0x004067c0
                                                          0x004067d6
                                                          0x004067db
                                                          0x00406813
                                                          0x00406813
                                                          0x00406817
                                                          0x00406843
                                                          0x00406845
                                                          0x0040684c
                                                          0x0040684f
                                                          0x00406852
                                                          0x00406852
                                                          0x00406857
                                                          0x00406857
                                                          0x00406859
                                                          0x0040685c
                                                          0x00406863
                                                          0x00406866
                                                          0x00406893
                                                          0x00406893
                                                          0x00406896
                                                          0x00406899
                                                          0x0040690d
                                                          0x0040690d
                                                          0x0040690d
                                                          0x00000000
                                                          0x0040690d
                                                          0x0040689b
                                                          0x004068a1
                                                          0x004068a4
                                                          0x004068a7
                                                          0x004068aa
                                                          0x004068ad
                                                          0x004068b0
                                                          0x004068b3
                                                          0x004068b6
                                                          0x004068b9
                                                          0x004068bc
                                                          0x004068d5
                                                          0x004068d7
                                                          0x004068da
                                                          0x004068db
                                                          0x004068de
                                                          0x004068e0
                                                          0x004068e3
                                                          0x004068e5
                                                          0x004068e7
                                                          0x004068ea
                                                          0x004068ec
                                                          0x004068ef
                                                          0x004068f3
                                                          0x004068f5
                                                          0x004068f5
                                                          0x004068f6
                                                          0x004068f9
                                                          0x004068fc
                                                          0x004068be
                                                          0x004068be
                                                          0x004068c6
                                                          0x004068cb
                                                          0x004068cd
                                                          0x004068d0
                                                          0x004068d0
                                                          0x004068ff
                                                          0x00406906
                                                          0x00406890
                                                          0x00406890
                                                          0x00406890
                                                          0x00406890
                                                          0x00000000
                                                          0x00406908
                                                          0x00000000
                                                          0x00406908
                                                          0x00406906
                                                          0x00406819
                                                          0x0040681c
                                                          0x0040681e
                                                          0x00406821
                                                          0x00406824
                                                          0x00406827
                                                          0x00406829
                                                          0x0040682c
                                                          0x0040682f
                                                          0x0040682f
                                                          0x00406832
                                                          0x00406832
                                                          0x00406835
                                                          0x0040683c
                                                          0x00406810
                                                          0x00406810
                                                          0x00406810
                                                          0x00406810
                                                          0x00000000
                                                          0x0040683e
                                                          0x00000000
                                                          0x0040683e
                                                          0x0040683c
                                                          0x004067c2
                                                          0x004067c5
                                                          0x004067c7
                                                          0x004067ca
                                                          0x00000000
                                                          0x00000000
                                                          0x00406529
                                                          0x00406529
                                                          0x0040652d
                                                          0x00406b72
                                                          0x00000000
                                                          0x00406b72
                                                          0x00406533
                                                          0x00406536
                                                          0x00406539
                                                          0x0040653c
                                                          0x0040653f
                                                          0x00406542
                                                          0x00406545
                                                          0x00406547
                                                          0x0040654a
                                                          0x0040654d
                                                          0x00406550
                                                          0x00406552
                                                          0x00406552
                                                          0x00406552
                                                          0x00000000
                                                          0x00000000
                                                          0x004066b4
                                                          0x004066b4
                                                          0x004066b8
                                                          0x00406b7e
                                                          0x00000000
                                                          0x00406b7e
                                                          0x004066be
                                                          0x004066c1
                                                          0x004066c4
                                                          0x004066c7
                                                          0x004066c9
                                                          0x004066c9
                                                          0x004066c9
                                                          0x004066cc
                                                          0x004066cf
                                                          0x004066d2
                                                          0x004066d5
                                                          0x004066d8
                                                          0x004066db
                                                          0x004066dc
                                                          0x004066de
                                                          0x004066de
                                                          0x004066de
                                                          0x004066e1
                                                          0x004066e4
                                                          0x004066e7
                                                          0x004066ea
                                                          0x004066ea
                                                          0x004066ea
                                                          0x004066ed
                                                          0x004066ef
                                                          0x004066ef
                                                          0x00000000
                                                          0x00000000
                                                          0x00406931
                                                          0x00406931
                                                          0x00406931
                                                          0x00406935
                                                          0x00000000
                                                          0x00000000
                                                          0x0040693b
                                                          0x0040693e
                                                          0x00406941
                                                          0x00406944
                                                          0x00406946
                                                          0x00406946
                                                          0x00406946
                                                          0x00406949
                                                          0x0040694c
                                                          0x0040694f
                                                          0x00406952
                                                          0x00406955
                                                          0x00406958
                                                          0x00406959
                                                          0x0040695b
                                                          0x0040695b
                                                          0x0040695b
                                                          0x0040695e
                                                          0x00406961
                                                          0x00406964
                                                          0x00406967
                                                          0x0040696a
                                                          0x0040696e
                                                          0x00406970
                                                          0x00406973
                                                          0x00000000
                                                          0x00406975
                                                          0x004066f2
                                                          0x004066f2
                                                          0x00000000
                                                          0x004066f2
                                                          0x00406973
                                                          0x00406ba8
                                                          0x00000000
                                                          0x00000000
                                                          0x004061d7
                                                          0x00406bdf
                                                          0x00406bdf
                                                          0x00000000
                                                          0x00406bdf
                                                          0x00406a2c
                                                          0x004069b3
                                                          0x004069b0
                                                          0x00000000
                                                          0x00406705

                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 83d4d9fa97144311a3e66a470cde7927608ab55fe6dc8c436fded4a10c430ead
                                                          • Instruction ID: 2ec41c1936be718984cf19d05ce660ecedc56656b80368bbb2ce29215557a5c8
                                                          • Opcode Fuzzy Hash: 83d4d9fa97144311a3e66a470cde7927608ab55fe6dc8c436fded4a10c430ead
                                                          • Instruction Fuzzy Hash: 53712571E04228CBDF28CF98C854BADBBB1FB44305F15816ED856BB281C7785996DF44
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040664D Relevance: 5.2, APIs: 4, Instructions: 168COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 98%
                                                          			E0040664D() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00406BE7))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4)); // executed
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}













                                                          0x00000000
                                                          0x0040664d
                                                          0x0040664d
                                                          0x00406651
                                                          0x0040667a
                                                          0x00406684
                                                          0x00406653
                                                          0x0040665c
                                                          0x00406669
                                                          0x0040666c
                                                          0x004069b0
                                                          0x004069b0
                                                          0x004069b3
                                                          0x004069b3
                                                          0x004069b3
                                                          0x004069b9
                                                          0x004069bf
                                                          0x004069c5
                                                          0x004069df
                                                          0x004069e2
                                                          0x004069e8
                                                          0x004069f3
                                                          0x004069f5
                                                          0x004069c7
                                                          0x004069c7
                                                          0x004069d6
                                                          0x004069da
                                                          0x004069da
                                                          0x004069ff
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a01
                                                          0x00406a05
                                                          0x00406bb4
                                                          0x00406bca
                                                          0x00406bd2
                                                          0x00406bd9
                                                          0x00406bdb
                                                          0x00406be2
                                                          0x00406be6
                                                          0x00406be6
                                                          0x00406a11
                                                          0x00406a18
                                                          0x00406a20
                                                          0x00406a23
                                                          0x00406a26
                                                          0x00406a26
                                                          0x00406a2c
                                                          0x00406a2c
                                                          0x004061c8
                                                          0x004061c8
                                                          0x004061c8
                                                          0x004061d1
                                                          0x00000000
                                                          0x00000000
                                                          0x004061d7
                                                          0x00000000
                                                          0x004061e2
                                                          0x00000000
                                                          0x00000000
                                                          0x004061eb
                                                          0x004061ee
                                                          0x004061f1
                                                          0x004061f5
                                                          0x00000000
                                                          0x00000000
                                                          0x004061fb
                                                          0x004061fe
                                                          0x00406200
                                                          0x00406201
                                                          0x00406204
                                                          0x00406206
                                                          0x00406207
                                                          0x00406209
                                                          0x0040620c
                                                          0x00406211
                                                          0x00406216
                                                          0x0040621f
                                                          0x00406232
                                                          0x00406235
                                                          0x00406241
                                                          0x00406269
                                                          0x0040626b
                                                          0x00406279
                                                          0x00406279
                                                          0x0040627d
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040626d
                                                          0x0040626d
                                                          0x00406270
                                                          0x00406271
                                                          0x00406271
                                                          0x00000000
                                                          0x0040626d
                                                          0x00406247
                                                          0x0040624c
                                                          0x0040624c
                                                          0x00406255
                                                          0x0040625d
                                                          0x00406260
                                                          0x00000000
                                                          0x00406266
                                                          0x00406266
                                                          0x00000000
                                                          0x00406266
                                                          0x00000000
                                                          0x00406283
                                                          0x00406283
                                                          0x00406287
                                                          0x00406b33
                                                          0x00000000
                                                          0x00406b33
                                                          0x00406290
                                                          0x004062a0
                                                          0x004062a3
                                                          0x004062a6
                                                          0x004062a6
                                                          0x004062a6
                                                          0x004062a9
                                                          0x004062ad
                                                          0x00000000
                                                          0x00000000
                                                          0x004062af
                                                          0x004062b5
                                                          0x004062df
                                                          0x004062e5
                                                          0x004062ec
                                                          0x00000000
                                                          0x004062ec
                                                          0x004062bb
                                                          0x004062be
                                                          0x004062c3
                                                          0x004062c3
                                                          0x004062ce
                                                          0x004062d6
                                                          0x004062d9
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040631e
                                                          0x00406324
                                                          0x00406327
                                                          0x00406334
                                                          0x0040633c
                                                          0x004069b0
                                                          0x00000000
                                                          0x00000000
                                                          0x004062f3
                                                          0x004062f3
                                                          0x004062f7
                                                          0x00406b42
                                                          0x00000000
                                                          0x00406b42
                                                          0x00406303
                                                          0x0040630e
                                                          0x0040630e
                                                          0x0040630e
                                                          0x00406311
                                                          0x00406314
                                                          0x00406317
                                                          0x0040631c
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x004069b3
                                                          0x004069b3
                                                          0x004069b9
                                                          0x004069bf
                                                          0x004069c5
                                                          0x004069df
                                                          0x004069e2
                                                          0x004069e8
                                                          0x004069f3
                                                          0x004069f5
                                                          0x004069c7
                                                          0x004069c7
                                                          0x004069d6
                                                          0x004069da
                                                          0x004069da
                                                          0x004069ff
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00406344
                                                          0x00406346
                                                          0x00406349
                                                          0x004063ba
                                                          0x004063bd
                                                          0x004063c0
                                                          0x004063c7
                                                          0x004063d1
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00000000
                                                          0x004069b0
                                                          0x004069b0
                                                          0x0040634b
                                                          0x0040634f
                                                          0x00406352
                                                          0x00406354
                                                          0x00406357
                                                          0x0040635a
                                                          0x0040635c
                                                          0x0040635f
                                                          0x00406361
                                                          0x00406366
                                                          0x00406369
                                                          0x0040636c
                                                          0x00406370
                                                          0x00406377
                                                          0x0040637a
                                                          0x00406381
                                                          0x00406385
                                                          0x0040638d
                                                          0x0040638d
                                                          0x0040638d
                                                          0x00406387
                                                          0x00406387
                                                          0x00406387
                                                          0x0040637c
                                                          0x0040637c
                                                          0x0040637c
                                                          0x00406391
                                                          0x00406394
                                                          0x004063b2
                                                          0x004063b4
                                                          0x00000000
                                                          0x00406396
                                                          0x00406396
                                                          0x00406399
                                                          0x0040639c
                                                          0x0040639f
                                                          0x004063a1
                                                          0x004063a1
                                                          0x004063a1
                                                          0x004063a4
                                                          0x004063a7
                                                          0x004063a9
                                                          0x004063aa
                                                          0x004063ad
                                                          0x00000000
                                                          0x004063ad
                                                          0x00000000
                                                          0x004065e3
                                                          0x004065e7
                                                          0x00406605
                                                          0x00406608
                                                          0x0040660f
                                                          0x00406612
                                                          0x00406615
                                                          0x00406618
                                                          0x0040661b
                                                          0x0040661e
                                                          0x00406620
                                                          0x00406627
                                                          0x00406628
                                                          0x0040662a
                                                          0x0040662d
                                                          0x00406630
                                                          0x00406633
                                                          0x00406633
                                                          0x00406638
                                                          0x00000000
                                                          0x00406638
                                                          0x004065e9
                                                          0x004065ec
                                                          0x004065ef
                                                          0x004065f9
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00000000
                                                          0x004069b0
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00406690
                                                          0x00406694
                                                          0x00000000
                                                          0x00000000
                                                          0x0040669a
                                                          0x0040669e
                                                          0x00000000
                                                          0x00000000
                                                          0x004066a4
                                                          0x004066a6
                                                          0x004066aa
                                                          0x004066aa
                                                          0x004066ad
                                                          0x004066b1
                                                          0x00000000
                                                          0x00000000
                                                          0x00406701
                                                          0x00406705
                                                          0x0040670c
                                                          0x0040670f
                                                          0x00406712
                                                          0x0040671c
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00000000
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00406707
                                                          0x00000000
                                                          0x00000000
                                                          0x00406728
                                                          0x0040672c
                                                          0x00406733
                                                          0x00406736
                                                          0x00406739
                                                          0x0040672e
                                                          0x0040672e
                                                          0x0040672e
                                                          0x0040673c
                                                          0x0040673f
                                                          0x00406742
                                                          0x00406742
                                                          0x00406745
                                                          0x00406748
                                                          0x0040674b
                                                          0x0040674b
                                                          0x0040674e
                                                          0x00406755
                                                          0x0040675a
                                                          0x00000000
                                                          0x00000000
                                                          0x004067e8
                                                          0x004067e8
                                                          0x004067ec
                                                          0x00406b8a
                                                          0x00000000
                                                          0x00406b8a
                                                          0x004067f2
                                                          0x004067f5
                                                          0x004067f8
                                                          0x004067fc
                                                          0x004067ff
                                                          0x00406805
                                                          0x00406807
                                                          0x00406807
                                                          0x00406807
                                                          0x0040680a
                                                          0x0040680d
                                                          0x00000000
                                                          0x00000000
                                                          0x004063dd
                                                          0x004063dd
                                                          0x004063e1
                                                          0x00406b4e
                                                          0x00000000
                                                          0x00406b4e
                                                          0x004063e7
                                                          0x004063ea
                                                          0x004063ed
                                                          0x004063f1
                                                          0x004063f4
                                                          0x004063fa
                                                          0x004063fc
                                                          0x004063fc
                                                          0x004063fc
                                                          0x004063ff
                                                          0x00406402
                                                          0x00406402
                                                          0x00406405
                                                          0x00406408
                                                          0x00000000
                                                          0x00000000
                                                          0x0040640e
                                                          0x00406414
                                                          0x00000000
                                                          0x00000000
                                                          0x0040641a
                                                          0x0040641a
                                                          0x0040641e
                                                          0x00406421
                                                          0x00406424
                                                          0x00406427
                                                          0x0040642a
                                                          0x0040642b
                                                          0x0040642e
                                                          0x00406430
                                                          0x00406436
                                                          0x00406439
                                                          0x0040643c
                                                          0x0040643f
                                                          0x00406442
                                                          0x00406445
                                                          0x00406448
                                                          0x00406464
                                                          0x00406467
                                                          0x0040646a
                                                          0x0040646d
                                                          0x00406474
                                                          0x00406478
                                                          0x0040647a
                                                          0x0040647e
                                                          0x0040644a
                                                          0x0040644a
                                                          0x0040644e
                                                          0x00406456
                                                          0x0040645b
                                                          0x0040645d
                                                          0x0040645f
                                                          0x0040645f
                                                          0x00406481
                                                          0x00406488
                                                          0x0040648b
                                                          0x00000000
                                                          0x00406491
                                                          0x00000000
                                                          0x00406491
                                                          0x00000000
                                                          0x00406496
                                                          0x00406496
                                                          0x0040649a
                                                          0x00406b5a
                                                          0x00000000
                                                          0x00406b5a
                                                          0x004064a0
                                                          0x004064a3
                                                          0x004064a6
                                                          0x004064aa
                                                          0x004064ad
                                                          0x004064b3
                                                          0x004064b5
                                                          0x004064b5
                                                          0x004064b5
                                                          0x004064b8
                                                          0x004064bb
                                                          0x004064bb
                                                          0x004064bb
                                                          0x004064c1
                                                          0x00000000
                                                          0x00000000
                                                          0x004064c3
                                                          0x004064c6
                                                          0x004064c9
                                                          0x004064cc
                                                          0x004064cf
                                                          0x004064d2
                                                          0x004064d5
                                                          0x004064d8
                                                          0x004064db
                                                          0x004064de
                                                          0x004064e1
                                                          0x004064f9
                                                          0x004064fc
                                                          0x004064ff
                                                          0x00406502
                                                          0x00406502
                                                          0x00406505
                                                          0x00406509
                                                          0x0040650b
                                                          0x004064e3
                                                          0x004064e3
                                                          0x004064eb
                                                          0x004064f0
                                                          0x004064f2
                                                          0x004064f4
                                                          0x004064f4
                                                          0x0040650e
                                                          0x00406515
                                                          0x00406518
                                                          0x00000000
                                                          0x0040651a
                                                          0x00000000
                                                          0x0040651a
                                                          0x00406518
                                                          0x0040651f
                                                          0x0040651f
                                                          0x0040651f
                                                          0x0040651f
                                                          0x00000000
                                                          0x00000000
                                                          0x0040655a
                                                          0x0040655a
                                                          0x0040655e
                                                          0x00406b66
                                                          0x00000000
                                                          0x00406b66
                                                          0x00406564
                                                          0x00406567
                                                          0x0040656a
                                                          0x0040656e
                                                          0x00406571
                                                          0x00406577
                                                          0x00406579
                                                          0x00406579
                                                          0x00406579
                                                          0x0040657c
                                                          0x0040657f
                                                          0x0040657f
                                                          0x00406585
                                                          0x00406523
                                                          0x00406523
                                                          0x00406526
                                                          0x00000000
                                                          0x00406526
                                                          0x00406587
                                                          0x00406587
                                                          0x0040658a
                                                          0x0040658d
                                                          0x00406590
                                                          0x00406593
                                                          0x00406596
                                                          0x00406599
                                                          0x0040659c
                                                          0x0040659f
                                                          0x004065a2
                                                          0x004065a5
                                                          0x004065bd
                                                          0x004065c0
                                                          0x004065c3
                                                          0x004065c6
                                                          0x004065c6
                                                          0x004065c9
                                                          0x004065cd
                                                          0x004065cf
                                                          0x004065a7
                                                          0x004065a7
                                                          0x004065af
                                                          0x004065b4
                                                          0x004065b6
                                                          0x004065b8
                                                          0x004065b8
                                                          0x004065d2
                                                          0x004065d9
                                                          0x004065dc
                                                          0x00000000
                                                          0x004065de
                                                          0x00000000
                                                          0x004065de
                                                          0x00000000
                                                          0x0040686b
                                                          0x0040686b
                                                          0x0040686f
                                                          0x00406b96
                                                          0x00000000
                                                          0x00406b96
                                                          0x00406875
                                                          0x00406878
                                                          0x0040687b
                                                          0x0040687f
                                                          0x00406882
                                                          0x00406888
                                                          0x0040688a
                                                          0x0040688a
                                                          0x0040688a
                                                          0x0040688d
                                                          0x00000000
                                                          0x00000000
                                                          0x0040663b
                                                          0x0040663b
                                                          0x0040663e
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00000000
                                                          0x004069b0
                                                          0x00000000
                                                          0x0040697a
                                                          0x0040697e
                                                          0x004069a0
                                                          0x004069a3
                                                          0x004069ad
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00000000
                                                          0x004069b0
                                                          0x004069b0
                                                          0x00406980
                                                          0x00406983
                                                          0x00406987
                                                          0x0040698a
                                                          0x0040698a
                                                          0x0040698d
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a37
                                                          0x00406a3b
                                                          0x00406a59
                                                          0x00406a59
                                                          0x00406a59
                                                          0x00406a60
                                                          0x00406a67
                                                          0x00406a6e
                                                          0x00406a6e
                                                          0x00000000
                                                          0x00406a6e
                                                          0x00406a3d
                                                          0x00406a40
                                                          0x00406a43
                                                          0x00406a46
                                                          0x00406a4d
                                                          0x00406991
                                                          0x00406991
                                                          0x00406994
                                                          0x00000000
                                                          0x00000000
                                                          0x00406b28
                                                          0x00406b2b
                                                          0x00406a2c
                                                          0x00000000
                                                          0x00000000
                                                          0x00406762
                                                          0x00406764
                                                          0x0040676b
                                                          0x0040676c
                                                          0x0040676e
                                                          0x00406771
                                                          0x00000000
                                                          0x00000000
                                                          0x00406779
                                                          0x0040677c
                                                          0x0040677f
                                                          0x00406781
                                                          0x00406783
                                                          0x00406783
                                                          0x00406784
                                                          0x00406787
                                                          0x0040678e
                                                          0x00406791
                                                          0x0040679f
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a75
                                                          0x00406a75
                                                          0x00406a78
                                                          0x00406a7f
                                                          0x00000000
                                                          0x00000000
                                                          0x00406a84
                                                          0x00406a84
                                                          0x00406a88
                                                          0x00406bc0
                                                          0x00000000
                                                          0x00406bc0
                                                          0x00406a8e
                                                          0x00406a91
                                                          0x00406a94
                                                          0x00406a98
                                                          0x00406a9b
                                                          0x00406aa1
                                                          0x00406aa3
                                                          0x00406aa3
                                                          0x00406aa3
                                                          0x00406aa6
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aa9
                                                          0x00406aac
                                                          0x00406aac
                                                          0x00406ab0
                                                          0x00406b10
                                                          0x00406b13
                                                          0x00406b18
                                                          0x00406b19
                                                          0x00406b1b
                                                          0x00406b1d
                                                          0x00406b20
                                                          0x00406a2c
                                                          0x00406a2c
                                                          0x00000000
                                                          0x00406a32
                                                          0x00406a2c
                                                          0x00406ab2
                                                          0x00406ab8
                                                          0x00406abb
                                                          0x00406abe
                                                          0x00406ac1
                                                          0x00406ac4
                                                          0x00406ac7
                                                          0x00406aca
                                                          0x00406acd
                                                          0x00406ad0
                                                          0x00406ad3
                                                          0x00406aec
                                                          0x00406aef
                                                          0x00406af2
                                                          0x00406af5
                                                          0x00406af9
                                                          0x00406afb
                                                          0x00406afb
                                                          0x00406afc
                                                          0x00406aff
                                                          0x00406ad5
                                                          0x00406ad5
                                                          0x00406add
                                                          0x00406ae2
                                                          0x00406ae4
                                                          0x00406ae7
                                                          0x00406ae7
                                                          0x00406b02
                                                          0x00406b09
                                                          0x00000000
                                                          0x00406b0b
                                                          0x00000000
                                                          0x00406b0b
                                                          0x00000000
                                                          0x004067a7
                                                          0x004067aa
                                                          0x004067e0
                                                          0x00406910
                                                          0x00406910
                                                          0x00406910
                                                          0x00406910
                                                          0x00406913
                                                          0x00406913
                                                          0x00406916
                                                          0x00406918
                                                          0x00406ba2
                                                          0x00000000
                                                          0x00406ba2
                                                          0x0040691e
                                                          0x00406921
                                                          0x00000000
                                                          0x00000000
                                                          0x00406927
                                                          0x0040692b
                                                          0x0040692e
                                                          0x0040692e
                                                          0x0040692e
                                                          0x00000000
                                                          0x0040692e
                                                          0x004067ac
                                                          0x004067ae
                                                          0x004067b0
                                                          0x004067b2
                                                          0x004067b5
                                                          0x004067b6
                                                          0x004067b8
                                                          0x004067ba
                                                          0x004067bd
                                                          0x004067c0
                                                          0x004067d6
                                                          0x004067db
                                                          0x00406813
                                                          0x00406813
                                                          0x00406817
                                                          0x00406843
                                                          0x00406845
                                                          0x0040684c
                                                          0x0040684f
                                                          0x00406852
                                                          0x00406852
                                                          0x00406857
                                                          0x00406857
                                                          0x00406859
                                                          0x0040685c
                                                          0x00406863
                                                          0x00406866
                                                          0x00406893
                                                          0x00406893
                                                          0x00406896
                                                          0x00406899
                                                          0x0040690d
                                                          0x0040690d
                                                          0x0040690d
                                                          0x00000000
                                                          0x0040690d
                                                          0x0040689b
                                                          0x004068a1
                                                          0x004068a4
                                                          0x004068a7
                                                          0x004068aa
                                                          0x004068ad
                                                          0x004068b0
                                                          0x004068b3
                                                          0x004068b6
                                                          0x004068b9
                                                          0x004068bc
                                                          0x004068d5
                                                          0x004068d7
                                                          0x004068da
                                                          0x004068db
                                                          0x004068de
                                                          0x004068e0
                                                          0x004068e3
                                                          0x004068e5
                                                          0x004068e7
                                                          0x004068ea
                                                          0x004068ec
                                                          0x004068ef
                                                          0x004068f3
                                                          0x004068f5
                                                          0x004068f5
                                                          0x004068f6
                                                          0x004068f9
                                                          0x004068fc
                                                          0x004068be
                                                          0x004068be
                                                          0x004068c6
                                                          0x004068cb
                                                          0x004068cd
                                                          0x004068d0
                                                          0x004068d0
                                                          0x004068ff
                                                          0x00406906
                                                          0x00406890
                                                          0x00406890
                                                          0x00406890
                                                          0x00406890
                                                          0x00000000
                                                          0x00406908
                                                          0x00000000
                                                          0x00406908
                                                          0x00406906
                                                          0x00406819
                                                          0x0040681c
                                                          0x0040681e
                                                          0x00406821
                                                          0x00406824
                                                          0x00406827
                                                          0x00406829
                                                          0x0040682c
                                                          0x0040682f
                                                          0x0040682f
                                                          0x00406832
                                                          0x00406832
                                                          0x00406835
                                                          0x0040683c
                                                          0x00406810
                                                          0x00406810
                                                          0x00406810
                                                          0x00406810
                                                          0x00000000
                                                          0x0040683e
                                                          0x00000000
                                                          0x0040683e
                                                          0x0040683c
                                                          0x004067c2
                                                          0x004067c5
                                                          0x004067c7
                                                          0x004067ca
                                                          0x00000000
                                                          0x00000000
                                                          0x00406529
                                                          0x00406529
                                                          0x0040652d
                                                          0x00406b72
                                                          0x00000000
                                                          0x00406b72
                                                          0x00406533
                                                          0x00406536
                                                          0x00406539
                                                          0x0040653c
                                                          0x0040653f
                                                          0x00406542
                                                          0x00406545
                                                          0x00406547
                                                          0x0040654a
                                                          0x0040654d
                                                          0x00406550
                                                          0x00406552
                                                          0x00406552
                                                          0x00406552
                                                          0x00000000
                                                          0x00000000
                                                          0x004066b4
                                                          0x004066b4
                                                          0x004066b8
                                                          0x00406b7e
                                                          0x00000000
                                                          0x00406b7e
                                                          0x004066be
                                                          0x004066c1
                                                          0x004066c4
                                                          0x004066c7
                                                          0x004066c9
                                                          0x004066c9
                                                          0x004066c9
                                                          0x004066cc
                                                          0x004066cf
                                                          0x004066d2
                                                          0x004066d5
                                                          0x004066d8
                                                          0x004066db
                                                          0x004066dc
                                                          0x004066de
                                                          0x004066de
                                                          0x004066de
                                                          0x004066e1
                                                          0x004066e4
                                                          0x004066e7
                                                          0x004066ea
                                                          0x004066ea
                                                          0x004066ea
                                                          0x004066ed
                                                          0x004066ef
                                                          0x004066ef
                                                          0x00000000
                                                          0x00000000
                                                          0x00406931
                                                          0x00406931
                                                          0x00406931
                                                          0x00406935
                                                          0x00000000
                                                          0x00000000
                                                          0x0040693b
                                                          0x0040693e
                                                          0x00406941
                                                          0x00406944
                                                          0x00406946
                                                          0x00406946
                                                          0x00406946
                                                          0x00406949
                                                          0x0040694c
                                                          0x0040694f
                                                          0x00406952
                                                          0x00406955
                                                          0x00406958
                                                          0x00406959
                                                          0x0040695b
                                                          0x0040695b
                                                          0x0040695b
                                                          0x0040695e
                                                          0x00406961
                                                          0x00406964
                                                          0x00406967
                                                          0x0040696a
                                                          0x0040696e
                                                          0x00406970
                                                          0x00406973
                                                          0x00000000
                                                          0x00406975
                                                          0x004066f2
                                                          0x004066f2
                                                          0x00000000
                                                          0x004066f2
                                                          0x00406973
                                                          0x00406ba8
                                                          0x00000000
                                                          0x00000000
                                                          0x004061d7
                                                          0x00406bdf
                                                          0x00406bdf
                                                          0x00000000
                                                          0x00406bdf
                                                          0x00406a2c
                                                          0x004069b3
                                                          0x004069b0

                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1b21a4910564614c6641403ac362d6aa440f40f6368f9ee5d1983abbc3d5a3b8
                                                          • Instruction ID: 94740bf10ed9628fc2a816943eb7322e71ed29eec5e37d1a6fe0f7c23d4f3e83
                                                          • Opcode Fuzzy Hash: 1b21a4910564614c6641403ac362d6aa440f40f6368f9ee5d1983abbc3d5a3b8
                                                          • Instruction Fuzzy Hash: 1D714571E04228CBDF28CF98C854BADBBB1FB44305F11806ED856BB281C7786A96DF44
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 004021D2 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E004021D2() {
				char _t32;
				CHAR* _t35;
				CHAR* _t37;
				void* _t39;

				_t37 = E00402A3A(_t32);
				_t35 = E00402A3A(0x11);
				 *((intOrPtr*)(_t39 + 8)) = E00402A3A(0x23);
				if(E00405FFD(_t37) != 0) {
					 *(_t39 - 0x64) =  *(_t39 - 8);
					 *((intOrPtr*)(_t39 - 0x60)) = 2;
					( &(_t37[1]))[lstrlenA(_t37)] = _t32;
					( &(_t35[1]))[lstrlenA(_t35)] = _t32;
					_t25 =  *((intOrPtr*)(_t39 + 8));
					 *(_t39 - 0x5c) = _t37;
					 *(_t39 - 0x58) = _t35;
					 *((intOrPtr*)(_t39 - 0x4a)) =  *((intOrPtr*)(_t39 + 8));
					 *((short*)(_t39 - 0x54)) =  *((intOrPtr*)(_t39 - 0x20));
					E00404F12(_t32, _t25);
					if(SHFileOperationA(_t39 - 0x64) != 0) {
						goto L1;
					}
				} else {
					L1:
					E00404F12(0xfffffff9, _t32); // executed
					 *((intOrPtr*)(_t39 - 4)) = 1;
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t39 - 4));
				return 0;
			}







                                                          0x004021da
                                                          0x004021e3
                                                          0x004021eb
                                                          0x004021f5
                                                          0x00402208
                                                          0x0040220b
                                                          0x00402218
                                                          0x00402221
                                                          0x00402225
                                                          0x0040222e
                                                          0x00402231
                                                          0x00402234
                                                          0x00402237
                                                          0x0040223b
                                                          0x0040224c
                                                          0x00000000
                                                          0x00402252
                                                          0x004021f7
                                                          0x004021f7
                                                          0x004021fa
                                                          0x004026a6
                                                          0x004026a6
                                                          0x004028d2
                                                          0x004028de

                                                          APIs
                                                            • Part of subcall function 00405FFD: FindFirstFileA.KERNELBASE(74D0FA90,00421558,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,0040589C,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,74D0FA90,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,74D0FA90,C:\Users\user\AppData\Local\Temp\), ref: 00406008
                                                            • Part of subcall function 00405FFD: FindClose.KERNELBASE(00000000), ref: 00406014
                                                          • lstrlenA.KERNEL32 ref: 00402212
                                                          • lstrlenA.KERNEL32(00000000), ref: 0040221C
                                                          • SHFileOperationA.SHELL32(?,?,?,00000000), ref: 00402244
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: FileFindlstrlen$CloseFirstOperation
                                                          • String ID:
                                                          • API String ID: 1486964399-0
                                                          • Opcode ID: 4b43ad2fd2ae0109c1b06b4ea4003848b846b00691f6cc86fd8f3cdf8ce68e64
                                                          • Instruction ID: 485cfeef1a85070ae400372cebe3f88e325275d82b46da5cee7092b21f42a8f6
                                                          • Opcode Fuzzy Hash: 4b43ad2fd2ae0109c1b06b4ea4003848b846b00691f6cc86fd8f3cdf8ce68e64
                                                          • Instruction Fuzzy Hash: 70117071904314ABCB10EFF98949A8EB7F8AF54318F20843BA101FB2D2D6BCC5019B29
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00401E44 Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 82%
                                                          			E00401E44() {
				void* _t15;
				void* _t24;
				void* _t26;
				void* _t31;

				_t28 = E00402A3A(_t24);
				E00404F12(0xffffffeb, _t13); // executed
				_t15 = E0040548A(_t28); // executed
				 *(_t31 + 8) = _t15;
				if(_t15 == _t24) {
					 *((intOrPtr*)(_t31 - 4)) = 1;
				} else {
					if( *((intOrPtr*)(_t31 - 0x20)) != _t24) {
						while(WaitForSingleObject( *(_t31 + 8), 0x64) == 0x102) {
							E004060CE(0xf);
						}
						GetExitCodeProcess( *(_t31 + 8), _t31 - 0xc);
						if( *((intOrPtr*)(_t31 - 0x24)) < _t24) {
							if( *(_t31 - 0xc) != _t24) {
								 *((intOrPtr*)(_t31 - 4)) = 1;
							}
						} else {
							E00405C57(_t26,  *(_t31 - 0xc));
						}
					}
					_push( *(_t31 + 8));
					CloseHandle();
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t31 - 4));
				return 0;
			}







                                                          0x00401e4a
                                                          0x00401e4f
                                                          0x00401e55
                                                          0x00401e5c
                                                          0x00401e5f
                                                          0x004026a6
                                                          0x00401e65
                                                          0x00401e68
                                                          0x00401e79
                                                          0x00401e74
                                                          0x00401e74
                                                          0x00401e8e
                                                          0x00401e97
                                                          0x00401ea7
                                                          0x00401ea9
                                                          0x00401ea9
                                                          0x00401e99
                                                          0x00401e9d
                                                          0x00401e9d
                                                          0x00401e97
                                                          0x00401eb0
                                                          0x00401eb3
                                                          0x00401eb3
                                                          0x004028d2
                                                          0x004028de

                                                          APIs
                                                            • Part of subcall function 00404F12: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4B
                                                            • Part of subcall function 00404F12: lstrlenA.KERNEL32(00402FCF,Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5B
                                                            • Part of subcall function 00404F12: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,00402FCF,00402FCF,Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,00000000,0040E8C0,00000000), ref: 00404F6E
                                                            • Part of subcall function 00404F12: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp\System.dll), ref: 00404F80
                                                            • Part of subcall function 00404F12: SendMessageA.USER32 ref: 00404FA6
                                                            • Part of subcall function 00404F12: SendMessageA.USER32 ref: 00404FC0
                                                            • Part of subcall function 00404F12: SendMessageA.USER32 ref: 00404FCE
                                                            • Part of subcall function 0040548A: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421510,Error launching installer), ref: 004054B3
                                                            • Part of subcall function 0040548A: CloseHandle.KERNEL32(?), ref: 004054C0
                                                          • WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E7E
                                                          • GetExitCodeProcess.KERNEL32 ref: 00401E8E
                                                          • CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EB3
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
                                                          • String ID:
                                                          • API String ID: 3521207402-0
                                                          • Opcode ID: 848446b87dd18d4c2bfcb69c8f9b0a7acaad5bd61242a7dc02bbb47a41f74e40
                                                          • Instruction ID: 49f7d359c4d218189077cc8fb8a526ed56d4096950e75cb47e310611910bd6fc
                                                          • Opcode Fuzzy Hash: 848446b87dd18d4c2bfcb69c8f9b0a7acaad5bd61242a7dc02bbb47a41f74e40
                                                          • Instruction Fuzzy Hash: C4016D31904104EBDF11AFA1C984A9E77B2EF00354F10817BFA01B52E1C7785A85AB9A
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00405BE0 Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 90%
                                                          			E00405BE0(void* _a4, int _a8, char* _a12, int _a16, void* _a20) {
				long _t20;
				long _t23;
				long _t24;
				char* _t26;

				asm("sbb eax, eax");
				_t26 = _a16;
				 *_t26 = 0;
				_t20 = RegOpenKeyExA(_a4, _a8, 0,  ~_a20 & 0x00000100 | 0x00020019,  &_a20); // executed
				if(_t20 == 0) {
					_a8 = 0x400;
					_t23 = RegQueryValueExA(_a20, _a12, 0,  &_a16, _t26,  &_a8); // executed
					if(_t23 != 0 || _a16 != 1 && _a16 != 2) {
						 *_t26 = 0;
					}
					_t26[0x3ff] = 0;
					_t24 = RegCloseKey(_a20); // executed
					return _t24;
				}
				return _t20;
			}







                                                          0x00405bf0
                                                          0x00405bf2
                                                          0x00405bff
                                                          0x00405c09
                                                          0x00405c11
                                                          0x00405c16
                                                          0x00405c2a
                                                          0x00405c32
                                                          0x00405c40
                                                          0x00405c40
                                                          0x00405c45
                                                          0x00405c4b
                                                          0x00000000
                                                          0x00405c4b
                                                          0x00405c54

                                                          APIs
                                                          • RegOpenKeyExA.KERNELBASE(80000002,00405E25,00000000,00000002,?,00000002,?,?,00405E25,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405C09
                                                          • RegQueryValueExA.KERNELBASE(?,?,00000000,00405E25,?,00405E25), ref: 00405C2A
                                                          • RegCloseKey.KERNELBASE(?), ref: 00405C4B
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: CloseOpenQueryValue
                                                          • String ID:
                                                          • API String ID: 3677997916-0
                                                          • Opcode ID: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
                                                          • Instruction ID: c16e3abce3e86e16c1a4588743a1117629dce573bc303fe916445e4d8ee7e6e7
                                                          • Opcode Fuzzy Hash: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
                                                          • Instruction Fuzzy Hash: B3015A7254420AEFEB128F64EC49EEB3FACEF14354F044036F944A6220D235D964DFA5
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00402482 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 86%
                                                          			E00402482(int* __ebx, char* __esi) {
				void* _t7;
				int _t8;
				long _t11;
				int* _t14;
				void* _t18;
				char* _t20;
				void* _t22;
				void* _t25;

				_t20 = __esi;
				_t14 = __ebx;
				_t7 = E00402B44(_t25, 0x20019); // executed
				_t18 = _t7;
				_t8 = E00402A1D(3);
				 *__esi = __ebx;
				if(_t18 == __ebx) {
					L7:
					 *((intOrPtr*)(_t22 - 4)) = 1;
				} else {
					 *(_t22 + 8) = 0x3ff;
					if( *((intOrPtr*)(_t22 - 0x18)) == __ebx) {
						_t11 = RegEnumValueA(_t18, _t8, __esi, _t22 + 8, __ebx, __ebx, __ebx, __ebx);
						__eflags = _t11;
						if(_t11 != 0) {
							goto L7;
						} else {
							goto L4;
						}
					} else {
						RegEnumKeyA(_t18, _t8, __esi, 0x3ff);
						L4:
						_t20[0x3ff] = _t14;
						_push(_t18);
						RegCloseKey();
					}
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t22 - 4));
				return 0;
			}











                                                          0x00402482
                                                          0x00402482
                                                          0x00402487
                                                          0x0040248e
                                                          0x00402490
                                                          0x00402497
                                                          0x00402499
                                                          0x004026a6
                                                          0x004026a6
                                                          0x0040249f
                                                          0x004024a7
                                                          0x004024aa
                                                          0x004024c3
                                                          0x004024c9
                                                          0x004024cb
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x004024ac
                                                          0x004024b0
                                                          0x004024d1
                                                          0x004024d1
                                                          0x004024d7
                                                          0x004024d8
                                                          0x004024d8
                                                          0x004024aa
                                                          0x004028d2
                                                          0x004028de

                                                          APIs
                                                            • Part of subcall function 00402B44: RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B6C
                                                          • RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024B0
                                                          • RegEnumValueA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 004024C3
                                                          • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024D8
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Enum$CloseOpenValue
                                                          • String ID:
                                                          • API String ID: 167947723-0
                                                          • Opcode ID: 12eff8342a69f2536c30b71af717bb3f9058c2ccca94daf16b45cc2e21864202
                                                          • Instruction ID: 070e1f6e5a6b9be8feed57f98e06303e5303b2278279fcdfa1a0cb603d5e6ac6
                                                          • Opcode Fuzzy Hash: 12eff8342a69f2536c30b71af717bb3f9058c2ccca94daf16b45cc2e21864202
                                                          • Instruction Fuzzy Hash: D3F0A272904100BFEB119F659D88E7B7A6DEB40344B10443EF505A61C0D6B849459A7A
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 100027E8 Relevance: 3.2, APIs: 2, Instructions: 156fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateFileA.KERNELBASE(00000000), ref: 100028A7
                                                          • GetLastError.KERNEL32 ref: 100029AE
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.524434554.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.524374525.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          • Associated: 00000000.00000002.524488197.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          • Associated: 00000000.00000002.524503265.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: CreateErrorFileLast
                                                          • String ID:
                                                          • API String ID: 1214770103-0
                                                          • Opcode ID: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
                                                          • Instruction ID: 700bf99a33fcd989ee77f819fa46e2371db99389a88ce2eb288524e3b596c0af
                                                          • Opcode Fuzzy Hash: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
                                                          • Instruction Fuzzy Hash: 9751A2BA908214DFFB10DF64DCC674937A4EB443D4F21842AEA08E726DCF34A9808B95
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00402410 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 84%
                                                          			E00402410(int* __ebx, char* __esi) {
				void* _t17;
				char* _t18;
				void* _t33;
				void* _t37;
				void* _t40;

				_t35 = __esi;
				_t27 = __ebx;
				_t17 = E00402B44(_t40, 0x20019); // executed
				_t33 = _t17;
				_t18 = E00402A3A(0x33);
				 *__esi = __ebx;
				if(_t33 == __ebx) {
					 *(_t37 - 4) = 1;
				} else {
					 *(_t37 - 0x34) = 0x400;
					if(RegQueryValueExA(_t33, _t18, __ebx, _t37 + 8, __esi, _t37 - 0x34) != 0) {
						L7:
						 *_t35 = _t27;
						 *(_t37 - 4) = 1;
					} else {
						if( *(_t37 + 8) == 4) {
							__eflags =  *(_t37 - 0x18) - __ebx;
							 *(_t37 - 4) = 0 |  *(_t37 - 0x18) == __ebx;
							E00405C57(__esi,  *__esi);
						} else {
							if( *(_t37 + 8) == 1 ||  *(_t37 + 8) == 2) {
								 *(_t37 - 4) =  *(_t37 - 0x18);
								_t35[0x3ff] = _t27;
							} else {
								goto L7;
							}
						}
					}
					_push(_t33);
					RegCloseKey();
				}
				 *0x423788 =  *0x423788 +  *(_t37 - 4);
				return 0;
			}








                                                          0x00402410
                                                          0x00402410
                                                          0x00402415
                                                          0x0040241c
                                                          0x0040241e
                                                          0x00402425
                                                          0x00402427
                                                          0x004026a6
                                                          0x0040242d
                                                          0x00402430
                                                          0x0040244b
                                                          0x0040247b
                                                          0x0040247b
                                                          0x0040247d
                                                          0x0040244d
                                                          0x00402451
                                                          0x0040246a
                                                          0x00402471
                                                          0x00402474
                                                          0x00402453
                                                          0x00402456
                                                          0x00402461
                                                          0x004024d1
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00402456
                                                          0x00402451
                                                          0x004024d7
                                                          0x004024d8
                                                          0x004024d8
                                                          0x004028d2
                                                          0x004028de

                                                          APIs
                                                            • Part of subcall function 00402B44: RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B6C
                                                          • RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 00402440
                                                          • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024D8
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: CloseOpenQueryValue
                                                          • String ID:
                                                          • API String ID: 3677997916-0
                                                          • Opcode ID: 43fdcb12208ecf4b22dbb00b887fd4ca96f50bb9be14fb34037b2d673bee9bdf
                                                          • Instruction ID: 5ce6926f2417f3d17e5e854e85a0bcf64bccf2bfa1e8e40673093317e398bbc6
                                                          • Opcode Fuzzy Hash: 43fdcb12208ecf4b22dbb00b887fd4ca96f50bb9be14fb34037b2d673bee9bdf
                                                          • Instruction Fuzzy Hash: A711A771905205EFDF14DF64C6889AEBBB4EF11349F20843FE541B62C0D2B84A85DB5A
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 59%
                                                          			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x423730;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x422eec =  *0x422eec + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x422eec, 0x7530,  *0x422ed4), 0); // executed
					}
				}
				return 0;
			}











                                                          0x0040138a
                                                          0x004013fa
                                                          0x0040139b
                                                          0x004013a0
                                                          0x00000000
                                                          0x00000000
                                                          0x004013a2
                                                          0x004013a3
                                                          0x004013ad
                                                          0x00000000
                                                          0x00401404
                                                          0x004013b0
                                                          0x004013b7
                                                          0x004013bd
                                                          0x004013be
                                                          0x004013c0
                                                          0x004013c2
                                                          0x004013b9
                                                          0x004013b9
                                                          0x004013ba
                                                          0x004013ba
                                                          0x004013c9
                                                          0x004013cb
                                                          0x004013f4
                                                          0x004013f4
                                                          0x004013c9
                                                          0x00000000

                                                          APIs
                                                          • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                          • SendMessageA.USER32 ref: 004013F4
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: MessageSend
                                                          • String ID:
                                                          • API String ID: 3850602802-0
                                                          • Opcode ID: a519dadb84f5fbb5742ded63e05e15cde03a873041ee9604df24846d4002906c
                                                          • Instruction ID: da56ad7cfcb2a9fecb994a09e4a0bd113f750103611445cd7b28aada07ee45e3
                                                          • Opcode Fuzzy Hash: a519dadb84f5fbb5742ded63e05e15cde03a873041ee9604df24846d4002906c
                                                          • Instruction Fuzzy Hash: 2E012831B24210ABE7294B389D04B6A369CE710328F11823BF811F72F1D6B8DC42DB4D
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00402308 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00402308(void* __ebx) {
				char* _t6;
				long _t8;
				void* _t11;
				void* _t15;
				long _t19;
				void* _t22;
				void* _t23;

				_t15 = __ebx;
				_t26 =  *(_t23 - 0x18) - __ebx;
				if( *(_t23 - 0x18) != __ebx) {
					_t6 = E00402A3A(0x22);
					_t18 =  *(_t23 - 0x18) & 0x00000002;
					__eflags =  *(_t23 - 0x18) & 0x00000002;
					_t8 = E00402A7A(E00402B2F( *((intOrPtr*)(_t23 - 0x24))), _t6, _t18); // executed
					_t19 = _t8;
					goto L4;
				} else {
					_t11 = E00402B44(_t26, 2); // executed
					_t22 = _t11;
					if(_t22 == __ebx) {
						L6:
						 *((intOrPtr*)(_t23 - 4)) = 1;
					} else {
						_t19 = RegDeleteValueA(_t22, E00402A3A(0x33));
						RegCloseKey(_t22);
						L4:
						if(_t19 != _t15) {
							goto L6;
						}
					}
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t23 - 4));
				return 0;
			}










                                                          0x00402308
                                                          0x00402308
                                                          0x0040230b
                                                          0x0040233a
                                                          0x00402342
                                                          0x00402342
                                                          0x00402350
                                                          0x00402355
                                                          0x00000000
                                                          0x0040230d
                                                          0x0040230f
                                                          0x00402314
                                                          0x00402318
                                                          0x004026a6
                                                          0x004026a6
                                                          0x0040231e
                                                          0x0040232e
                                                          0x00402330
                                                          0x00402357
                                                          0x00402359
                                                          0x00000000
                                                          0x0040235f
                                                          0x00402359
                                                          0x00402318
                                                          0x004028d2
                                                          0x004028de

                                                          APIs
                                                            • Part of subcall function 00402B44: RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B6C
                                                          • RegDeleteValueA.ADVAPI32(00000000,00000000,00000033), ref: 00402327
                                                          • RegCloseKey.ADVAPI32(00000000), ref: 00402330
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: CloseDeleteOpenValue
                                                          • String ID:
                                                          • API String ID: 849931509-0
                                                          • Opcode ID: 3d048db30165a87dbbda70ec83d819f5182c4ff2759fa8fbc0a094342d08bd4b
                                                          • Instruction ID: 0b8f6a46cfbad05769843233fc9109b41d2ceb5d24a7fa4f39b64bc1fd674853
                                                          • Opcode Fuzzy Hash: 3d048db30165a87dbbda70ec83d819f5182c4ff2759fa8fbc0a094342d08bd4b
                                                          • Instruction Fuzzy Hash: CDF04473A00110ABDB10BFA48A4EAAE72799B50345F14443BF201B61C1D9BD4D12966D
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040155B Relevance: 3.0, APIs: 2, Instructions: 28COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • ShowWindow.USER32(0001043A), ref: 00401579
                                                          • ShowWindow.USER32(00010434), ref: 0040158E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: ShowWindow
                                                          • String ID:
                                                          • API String ID: 1268545403-0
                                                          • Opcode ID: eefc9c2eba5680e91e0ebc83984cde26ecf89c5aeacf34c607b8bcbd51dc0c8b
                                                          • Instruction ID: 6a1362a081380b38d7ea923c07575874152cb2511cc7df5c202f84d8e6e7dbc6
                                                          • Opcode Fuzzy Hash: eefc9c2eba5680e91e0ebc83984cde26ecf89c5aeacf34c607b8bcbd51dc0c8b
                                                          • Instruction Fuzzy Hash: AEF0E577B182806FDB25DB74EE8086E7BF6DB9531075901BFD101A3591C2B89C08D728
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00406092 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00406092(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x409240);
				_t5 = GetModuleHandleA( *(_t10 + 0x409240));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x409244));
				}
				_t5 = E00406024(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}





                                                          0x0040609a
                                                          0x0040609d
                                                          0x004060a4
                                                          0x004060ac
                                                          0x004060b8
                                                          0x00000000
                                                          0x004060bf
                                                          0x004060af
                                                          0x004060b6
                                                          0x00000000
                                                          0x004060c7
                                                          0x00000000

                                                          APIs
                                                          • GetModuleHandleA.KERNEL32(?,?,?,00403143,00000009), ref: 004060A4
                                                          • GetProcAddress.KERNEL32(00000000,?), ref: 004060BF
                                                            • Part of subcall function 00406024: GetSystemDirectoryA.KERNEL32 ref: 0040603B
                                                            • Part of subcall function 00406024: wsprintfA.USER32 ref: 00406074
                                                            • Part of subcall function 00406024: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406088
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                          • String ID:
                                                          • API String ID: 2547128583-0
                                                          • Opcode ID: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
                                                          • Instruction ID: f390ed2799c289b087c769a87f24dfac638062b8da6604b2acd18c4b1555f769
                                                          • Opcode Fuzzy Hash: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
                                                          • Instruction Fuzzy Hash: B4E08632644111A6D320A7709D0493B72EC9E84710302483EF906F2191D738AC259669
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040596C Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 68%
                                                          			E0040596C(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}





                                                          0x00405970
                                                          0x0040597d
                                                          0x00405992
                                                          0x00405998

                                                          APIs
                                                          • GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,80000000,00000003), ref: 00405970
                                                          • CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405992
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: File$AttributesCreate
                                                          • String ID:
                                                          • API String ID: 415043291-0
                                                          • Opcode ID: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
                                                          • Instruction ID: 2848333a8a5b20597e43067d17cc290ce391feab13c7f73248cb22e1b8f9cacf
                                                          • Opcode Fuzzy Hash: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
                                                          • Instruction Fuzzy Hash: 5CD09E31658301AFEF098F20DD16F2EBAA2EB84B01F10962CBA82950E0D6755C159B26
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00405947 Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00405947(CHAR* _a4) {
				signed char _t3;
				signed char _t7;

				_t3 = GetFileAttributesA(_a4); // executed
				_t7 = _t3;
				if(_t7 != 0xffffffff) {
					SetFileAttributesA(_a4, _t3 & 0x000000fe);
				}
				return _t7;
			}





                                                          0x0040594c
                                                          0x00405952
                                                          0x00405957
                                                          0x00405960
                                                          0x00405960
                                                          0x00405969

                                                          APIs
                                                          • GetFileAttributesA.KERNELBASE(?,?,0040555F,?,?,00000000,00405742,?,?,?,?), ref: 0040594C
                                                          • SetFileAttributesA.KERNEL32(?,00000000), ref: 00405960
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: AttributesFile
                                                          • String ID:
                                                          • API String ID: 3188754299-0
                                                          • Opcode ID: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
                                                          • Instruction ID: 96e5362f07f59601f7516fe8bcac2aa0a8151a45168581d09323fa3b8cc485cf
                                                          • Opcode Fuzzy Hash: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
                                                          • Instruction Fuzzy Hash: F7D01272908121AFC2102738ED0C89BBF65EB543717058B35FDB9F22F0D7304C568AA6
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00405455 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00405455(CHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryA(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}




                                                          0x0040545b
                                                          0x00405463
                                                          0x00000000
                                                          0x00405469
                                                          0x00000000

                                                          APIs
                                                          • CreateDirectoryA.KERNELBASE(?,00000000,004030CC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 0040545B
                                                          • GetLastError.KERNEL32 ref: 00405469
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: CreateDirectoryErrorLast
                                                          • String ID:
                                                          • API String ID: 1375471231-0
                                                          • Opcode ID: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
                                                          • Instruction ID: ace853db513f64caea17b5c73fb52fb3118c2a3fabff3065b7385b8b337d2f64
                                                          • Opcode Fuzzy Hash: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
                                                          • Instruction Fuzzy Hash: 9DC08C30B18101EAC6100B30AE087073D50AB00742F1444356206E10E0C6309050CD2F
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040255C Relevance: 1.6, APIs: 1, Instructions: 74COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E0040255C(intOrPtr __ebx, void* __edi, void* __esi) {
				intOrPtr _t26;
				void* _t35;
				void* _t38;

				 *((intOrPtr*)(_t35 - 8)) = __ebx;
				_t26 = E00402A1D(2);
				_t38 = _t26 - 1;
				 *((intOrPtr*)(_t35 - 0xc)) = _t26;
				if(_t38 < 0) {
					L24:
					 *0x423788 =  *0x423788 +  *(_t35 - 4);
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *((intOrPtr*)(__ebp - 0xc)) = 0x3ff;
					}
					if( *__esi == __bl) {
						L21:
						__esi =  *((intOrPtr*)(__ebp - 8));
						goto L22;
					} else {
						 *((char*)(__ebp + 0xb)) = __bl;
						 *(__ebp - 0x30) = E00405C70(__ecx, __esi);
						if( *((intOrPtr*)(__ebp - 0xc)) <= __ebx) {
							goto L21;
						} else {
							__esi =  *((intOrPtr*)(__ebp - 8));
							while(1) {
								__eax = __ebp - 0xd;
								__eax = E004059E4( *(__ebp - 0x30), __ebp - 0xd, 1); // executed
								if(__eax == 0) {
									break;
								}
								if( *((intOrPtr*)(__ebp - 0x1c)) != __ebx) {
									 *(__ebp - 0xd) & 0x000000ff = E00405C57(__edi,  *(__ebp - 0xd) & 0x000000ff);
								} else {
									if( *((char*)(__ebp + 0xb)) == 0xd ||  *((char*)(__ebp + 0xb)) == 0xa) {
										__al =  *(__ebp - 0xd);
										if( *((intOrPtr*)(__ebp + 0xb)) == __al || __al != 0xd && __al != 0xa) {
											__eax = SetFilePointer( *(__ebp - 0x30), 0xffffffff, __ebx, 1);
										} else {
											 *((char*)(__esi + __edi)) = __al;
											__esi = __esi + 1;
										}
										break;
									} else {
										__al =  *(__ebp - 0xd);
										 *((char*)(__esi + __edi)) = __al;
										__esi = __esi + 1;
										 *((char*)(__ebp + 0xb)) = __al;
										if(__al == __bl) {
											break;
										} else {
											if(__esi <  *((intOrPtr*)(__ebp - 0xc))) {
												continue;
											} else {
												break;
											}
										}
									}
								}
								goto L25;
							}
							L22:
							 *((char*)(__esi + __edi)) = __bl;
							if(_t38 == 0) {
								 *(_t35 - 4) = 1;
							}
							goto L24;
						}
					}
				}
				L25:
				return 0;
			}






                                                          0x0040255e
                                                          0x00402561
                                                          0x00402566
                                                          0x00402569
                                                          0x0040256c
                                                          0x004028cf
                                                          0x004028d2
                                                          0x00402572
                                                          0x00402572
                                                          0x00402579
                                                          0x0040257b
                                                          0x0040257b
                                                          0x00402580
                                                          0x00402608
                                                          0x00402608
                                                          0x00000000
                                                          0x00402586
                                                          0x00402587
                                                          0x00402592
                                                          0x00402595
                                                          0x00000000
                                                          0x00402597
                                                          0x00402597
                                                          0x0040259a
                                                          0x0040259a
                                                          0x004025a3
                                                          0x004025aa
                                                          0x00000000
                                                          0x00000000
                                                          0x004025af
                                                          0x004025d8
                                                          0x004025b1
                                                          0x004025b5
                                                          0x004025e2
                                                          0x004025e8
                                                          0x00402600
                                                          0x004025f2
                                                          0x004025f2
                                                          0x004025f5
                                                          0x004025f5
                                                          0x00000000
                                                          0x004025bd
                                                          0x004025bd
                                                          0x004025c0
                                                          0x004025c3
                                                          0x004025c6
                                                          0x004025c9
                                                          0x00000000
                                                          0x004025cb
                                                          0x004025ce
                                                          0x00000000
                                                          0x004025d0
                                                          0x00000000
                                                          0x004025d0
                                                          0x004025ce
                                                          0x004025c9
                                                          0x004025b5
                                                          0x00000000
                                                          0x004025af
                                                          0x0040260b
                                                          0x0040260b
                                                          0x004015a8
                                                          0x004026a6
                                                          0x004026a6
                                                          0x00000000
                                                          0x004015a8
                                                          0x00402595
                                                          0x00402580
                                                          0x004028d8
                                                          0x004028de

                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: wsprintf
                                                          • String ID:
                                                          • API String ID: 2111968516-0
                                                          • Opcode ID: 7ea698501722721c26a8941e34d84e293da030ffcd79d9a631de662ee5d141bb
                                                          • Instruction ID: f0e9407761540611d0924c316636f69a46329dcf8394c365819cdff4e6cfa024
                                                          • Opcode Fuzzy Hash: 7ea698501722721c26a8941e34d84e293da030ffcd79d9a631de662ee5d141bb
                                                          • Instruction Fuzzy Hash: 5C210870C04299BEDF318B584A485AFBF749B01318F1480BBE891B63D1C1BC8A85EF1D
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00402616 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 44%
                                                          			E00402616(void* __eflags) {
				long _t6;
				long _t8;
				LONG* _t10;
				void* _t12;
				void* _t15;
				void* _t17;

				_push(ds);
				if(__eflags != 0) {
					_t6 = E00402A1D(2);
					_t8 = SetFilePointer(E00405C70(_t12, _t15), _t6, _t10,  *(_t17 - 0x1c)); // executed
					if( *((intOrPtr*)(_t17 - 0x24)) >= _t10) {
						_push(_t8);
						E00405C57();
					}
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t17 - 4));
				return 0;
			}









                                                          0x00402616
                                                          0x00402617
                                                          0x00402623
                                                          0x00402630
                                                          0x00402639
                                                          0x00402875
                                                          0x00402877
                                                          0x00402877
                                                          0x00402639
                                                          0x004028d2
                                                          0x004028de

                                                          APIs
                                                          • SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 00402630
                                                            • Part of subcall function 00405C57: wsprintfA.USER32 ref: 00405C64
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: FilePointerwsprintf
                                                          • String ID:
                                                          • API String ID: 327478801-0
                                                          • Opcode ID: 709a1efb691e22b24d5139b65a0299c5cd3135bd5f72422e81660ad42db7e028
                                                          • Instruction ID: 52cb416d5db8590b47b50ad60af093b1f6dbc599d2fc32e6c75259d831e6d5c7
                                                          • Opcode Fuzzy Hash: 709a1efb691e22b24d5139b65a0299c5cd3135bd5f72422e81660ad42db7e028
                                                          • Instruction Fuzzy Hash: 01E04F76A04104BAE701FBA56E4DDBF73AADB50319B60843BF601F00C1C77D89459A3E
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00402283 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00402283(int __eax, CHAR* __ebx) {
				CHAR* _t11;
				void* _t13;
				CHAR* _t14;
				void* _t18;
				int _t22;

				_t11 = __ebx;
				_t5 = __eax;
				_t14 = 0;
				if(__eax != __ebx) {
					__eax = E00402A3A(__ebx);
				}
				if(_t13 != _t11) {
					_t14 = E00402A3A(0x11);
				}
				if( *((intOrPtr*)(_t18 - 0x18)) != _t11) {
					_t11 = E00402A3A(0x22);
				}
				_t5 = WritePrivateProfileStringA(0, _t14, _t11, E00402A3A(0xffffffcd)); // executed
				_t22 = _t5;
				if(_t22 == 0) {
					 *((intOrPtr*)(_t18 - 4)) = 1;
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t18 - 4));
				return 0;
			}








                                                          0x00402283
                                                          0x00402283
                                                          0x00402285
                                                          0x00402289
                                                          0x0040228c
                                                          0x00402294
                                                          0x00402298
                                                          0x004022a1
                                                          0x004022a1
                                                          0x004022a6
                                                          0x004022af
                                                          0x004022af
                                                          0x004022bc
                                                          0x004015a6
                                                          0x004015a8
                                                          0x004026a6
                                                          0x004026a6
                                                          0x004028d2
                                                          0x004028de

                                                          APIs
                                                          • WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 004022BC
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: PrivateProfileStringWrite
                                                          • String ID:
                                                          • API String ID: 390214022-0
                                                          • Opcode ID: 4656573f168c310efd594f08e96abc660716981113b3fc3e41d9438b56e455a3
                                                          • Instruction ID: ed5e863b5af70a22674a87f6432e4eb84017b1e79b4e81bbc09640d5f5368664
                                                          • Opcode Fuzzy Hash: 4656573f168c310efd594f08e96abc660716981113b3fc3e41d9438b56e455a3
                                                          • Instruction Fuzzy Hash: 8AE04F31B001746FDB217AF14E8EE7F11989B84348B64417EF601B62C3DDBC4D434AA9
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00401717 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00401717() {
				long _t5;
				CHAR* _t8;
				CHAR* _t12;
				void* _t14;
				long _t17;

				_t5 = SearchPathA(_t8, E00402A3A(0xffffffff), _t8, 0x400, _t12, _t14 + 8); // executed
				_t17 = _t5;
				if(_t17 == 0) {
					 *((intOrPtr*)(_t14 - 4)) = 1;
					 *_t12 = _t8;
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t14 - 4));
				return 0;
			}








                                                          0x0040172b
                                                          0x00401731
                                                          0x00401733
                                                          0x0040267a
                                                          0x00402681
                                                          0x00402681
                                                          0x004028d2
                                                          0x004028de

                                                          APIs
                                                          • SearchPathA.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 0040172B
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: PathSearch
                                                          • String ID:
                                                          • API String ID: 2203818243-0
                                                          • Opcode ID: 985a7ae01e69da493872186c6c10ed37eba87bebab26c0abac89a8346f6e59b4
                                                          • Instruction ID: 4c956aff6f0d258c6848a8c99906dcba9d38e98bcd0b2081640ab90df76b8672
                                                          • Opcode Fuzzy Hash: 985a7ae01e69da493872186c6c10ed37eba87bebab26c0abac89a8346f6e59b4
                                                          • Instruction Fuzzy Hash: E5E0D8B2204100ABE700DB549D48FAA3798DB10368B30853BF201A50C1D2B89A459629
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00402B44 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 75%
                                                          			E00402B44(void* __eflags, void* _a4) {
				char* _t8;
				intOrPtr _t9;
				signed int _t11;

				_t8 = E00402A3A(0x22);
				_t9 =  *0x40a7e8; // 0x386fd6c
				_t11 = RegOpenKeyExA(E00402B2F( *((intOrPtr*)(_t9 + 4))), _t8, 0,  *0x4237b0 | _a4,  &_a4); // executed
				asm("sbb eax, eax");
				return  !( ~_t11) & _a4;
			}






                                                          0x00402b58
                                                          0x00402b5e
                                                          0x00402b6c
                                                          0x00402b74
                                                          0x00402b7c

                                                          APIs
                                                          • RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B6C
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Open
                                                          • String ID:
                                                          • API String ID: 71445658-0
                                                          • Opcode ID: 11541d565f05363a0d465782138c1ad9d83dbb2602eb40d854f4a90bf0086a6c
                                                          • Instruction ID: 6913ff832cf321f63cdd7bb00c8cc70b6829a5dd8220bacc95ff598af340a114
                                                          • Opcode Fuzzy Hash: 11541d565f05363a0d465782138c1ad9d83dbb2602eb40d854f4a90bf0086a6c
                                                          • Instruction Fuzzy Hash: 7FE04FB6240108AFDB00DFA4DD46F9577FCE718701F008021B608D7091C674E5508B69
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00405A13 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00405A13(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}





                                                          0x00405a17
                                                          0x00405a27
                                                          0x00405a2f
                                                          0x00000000
                                                          0x00405a36
                                                          0x00000000
                                                          0x00405a38

                                                          APIs
                                                          • WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,00000020,?,0040305C,00000000,0040A8C0,00000020,0040A8C0,00000020,000000FF,00000004,00000000), ref: 00405A27
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: FileWrite
                                                          • String ID:
                                                          • API String ID: 3934441357-0
                                                          • Opcode ID: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
                                                          • Instruction ID: edb1125888c6416cb1e0b95ca9609c2ac4c4c792cbd4e8f88826aa2405e91300
                                                          • Opcode Fuzzy Hash: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
                                                          • Instruction Fuzzy Hash: D7E0EC3261425EEFDF109E659C40AEB7B6DEB053A4F048532FD25E2150E271E8219FB5
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 004059E4 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E004059E4(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}





                                                          0x004059e8
                                                          0x004059f8
                                                          0x00405a00
                                                          0x00000000
                                                          0x00405a07
                                                          0x00000000
                                                          0x00405a09

                                                          APIs
                                                          • ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040308E,00000000,00000000,00402EEB,000000FF,00000004,00000000,00000000,00000000), ref: 004059F8
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: FileRead
                                                          • String ID:
                                                          • API String ID: 2738559852-0
                                                          • Opcode ID: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
                                                          • Instruction ID: 6c2e581bc83b2d89c4a498056592e8f52b2bea012b9e1656670f40d352b29975
                                                          • Opcode Fuzzy Hash: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
                                                          • Instruction Fuzzy Hash: 4DE0EC3272429AABDF109E559C44EEF7BACEB05360F048932FD15E3190D235ED219FA9
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 1000270B Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			_entry_(intOrPtr _a4, intOrPtr _a8) {

				 *0x10004038 = _a4;
				if(_a8 == 1) {
					VirtualProtect(0x1000404c, 4, 0x40, 0x1000403c); // executed
					 *0x1000404c = 0xc2;
					 *0x1000403c = 0;
					 *0x10004044 = 0;
					 *0x10004058 = 0;
					 *0x10004048 = 0;
					 *0x10004040 = 0;
					 *0x10004050 = 0;
					 *0x1000404e = 0;
				}
				return 1;
			}



                                                          0x10002714
                                                          0x10002719
                                                          0x10002729
                                                          0x10002731
                                                          0x10002738
                                                          0x1000273d
                                                          0x10002742
                                                          0x10002747
                                                          0x1000274c
                                                          0x10002751
                                                          0x10002756
                                                          0x10002756
                                                          0x1000275e

                                                          APIs
                                                          • VirtualProtect.KERNELBASE(1000404C,00000004,00000040,1000403C), ref: 10002729
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.524434554.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.524374525.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          • Associated: 00000000.00000002.524488197.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          • Associated: 00000000.00000002.524503265.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: ProtectVirtual
                                                          • String ID:
                                                          • API String ID: 544645111-0
                                                          • Opcode ID: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
                                                          • Instruction ID: 4f82052a8ee677216feeb46ba648c84afb962adc58c95b92ee0d34447feb5494
                                                          • Opcode Fuzzy Hash: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
                                                          • Instruction Fuzzy Hash: B5F09BF19092A0DEF360DF688CC4B063FE4E3983D5B03892AE358F6269EB7441448B19
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00401595 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00401595() {
				int _t5;
				void* _t11;
				int _t14;

				_t5 = SetFileAttributesA(E00402A3A(0xfffffff0),  *(_t11 - 0x24)); // executed
				_t14 = _t5;
				if(_t14 == 0) {
					 *((intOrPtr*)(_t11 - 4)) = 1;
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t11 - 4));
				return 0;
			}






                                                          0x004015a0
                                                          0x004015a6
                                                          0x004015a8
                                                          0x004026a6
                                                          0x004026a6
                                                          0x004028d2
                                                          0x004028de

                                                          APIs
                                                          • SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A0
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: AttributesFile
                                                          • String ID:
                                                          • API String ID: 3188754299-0
                                                          • Opcode ID: 2f4aa05d9b43ba945a2a5a5a670270cec761036e62b58b4324ee924eab4e4851
                                                          • Instruction ID: e7eaa26ee73965d29c722757b3dcf4c0106c30ff4276e434a6a3861fc4943bf0
                                                          • Opcode Fuzzy Hash: 2f4aa05d9b43ba945a2a5a5a670270cec761036e62b58b4324ee924eab4e4851
                                                          • Instruction Fuzzy Hash: 65D01273B14100ABDB10EBA49A08A9D73A5AB60329B308637D201F21D1D6B9CA55AA29
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00403F2A Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00403F2A(int _a4) {
				struct HWND__* _t2;
				long _t3;

				_t2 =  *0x422ed8; // 0x1042e
				if(_t2 != 0) {
					_t3 = SendMessageA(_t2, _a4, 0, 0); // executed
					return _t3;
				}
				return _t2;
			}





                                                          0x00403f2a
                                                          0x00403f31
                                                          0x00403f3c
                                                          0x00000000
                                                          0x00403f3c
                                                          0x00403f42

                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: MessageSend
                                                          • String ID:
                                                          • API String ID: 3850602802-0
                                                          • Opcode ID: 875450fc840247aea6e73403ee44149e02d5474b467ece0a28835bfda1230da9
                                                          • Instruction ID: b8addb9e81407d18270a6acc8ad8b47d243914a4c892372c87671a3bfdf31127
                                                          • Opcode Fuzzy Hash: 875450fc840247aea6e73403ee44149e02d5474b467ece0a28835bfda1230da9
                                                          • Instruction Fuzzy Hash: B6C04C71B482017AEA21CB509D49F0677686750B01F5584757210E50D0C6B4E451D62D
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00403F13 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00403F13(int _a4) {
				long _t2;

				_t2 = SendMessageA( *0x423708, 0x28, _a4, 1); // executed
				return _t2;
			}




                                                          0x00403f21
                                                          0x00403f27

                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: MessageSend
                                                          • String ID:
                                                          • API String ID: 3850602802-0
                                                          • Opcode ID: 3bdb3c033a7d800f3f5983e71921b41162ac414239058931643885a1338ef954
                                                          • Instruction ID: 7b5ccc39adf6f72de5191684d4495c6b43ffe58f78915606d69c4a7e6f44d702
                                                          • Opcode Fuzzy Hash: 3bdb3c033a7d800f3f5983e71921b41162ac414239058931643885a1338ef954
                                                          • Instruction Fuzzy Hash: F3B092B5684200BAEE224B40DD09F457EA2E7A4702F008024B300240B0C6B200A1DB19
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00403091 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00403091(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x409018, _a4, 0, 0); // executed
				return _t2;
			}




                                                          0x0040309f
                                                          0x004030a5

                                                          APIs
                                                          • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E2D,?), ref: 0040309F
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: FilePointer
                                                          • String ID:
                                                          • API String ID: 973152223-0
                                                          • Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
                                                          • Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
                                                          • Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
                                                          • Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00403F00 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00403F00(int _a4) {
				int _t2;

				_t2 = EnableWindow( *0x41fd04, _a4); // executed
				return _t2;
			}




                                                          0x00403f0a
                                                          0x00403f10

                                                          APIs
                                                          • KiUserCallbackDispatcher.NTDLL(?,00403CDD), ref: 00403F0A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: CallbackDispatcherUser
                                                          • String ID:
                                                          • API String ID: 2492992576-0
                                                          • Opcode ID: 12c11760972377b051275edfb0549e2da63da5a0a3d5c66f9a0e944dd115ee42
                                                          • Instruction ID: 627edf876ec6fe827e8ded8b6e0f84c3e1bff33d3b07c91bc4a796ca35ff40dd
                                                          • Opcode Fuzzy Hash: 12c11760972377b051275edfb0549e2da63da5a0a3d5c66f9a0e944dd115ee42
                                                          • Instruction Fuzzy Hash: CAA00176808101ABCB029B50FF09D9ABF62ABA5705B028435E65694174C7325865FF1A
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E004014D6() {
				long _t2;
				void* _t6;
				void* _t10;

				_t2 = E00402A1D(_t6);
				if(_t2 <= 1) {
					_t2 = 1;
				}
				Sleep(_t2); // executed
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t10 - 4));
				return 0;
			}






                                                          0x004014d7
                                                          0x004014df
                                                          0x004014e3
                                                          0x004014e3
                                                          0x004014e5
                                                          0x004028d2
                                                          0x004028de

                                                          APIs
                                                          • Sleep.KERNELBASE(00000000), ref: 004014E5
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Sleep
                                                          • String ID:
                                                          • API String ID: 3472027048-0
                                                          • Opcode ID: faaa25f1f06cdb1d059934445d5023d073224a6f28801890f9ea55e9f0b31bdc
                                                          • Instruction ID: 9c89d06b59eba3ca4e7b2e7dbe410ddf5a45079d0a4e8d0192c1fc54d184d5ff
                                                          • Opcode Fuzzy Hash: faaa25f1f06cdb1d059934445d5023d073224a6f28801890f9ea55e9f0b31bdc
                                                          • Instruction Fuzzy Hash: A2D0C777B1454057D710E7B87E8545A63A9F7513253204937D502F1091D578C9059A29
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 10001215 Relevance: 1.3, APIs: 1, Instructions: 4memoryCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E10001215() {
				void* _t1;

				_t1 = GlobalAlloc(0x40,  *0x1000405c); // executed
				return _t1;
			}




                                                          0x1000121d
                                                          0x10001223

                                                          APIs
                                                          • GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.524434554.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.524374525.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          • Associated: 00000000.00000002.524488197.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          • Associated: 00000000.00000002.524503265.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: AllocGlobal
                                                          • String ID:
                                                          • API String ID: 3761449716-0
                                                          • Opcode ID: 6989041179a6ec659f8410a82a3610e1053cc9f4ca9d652552d89decbf4b4a90
                                                          • Instruction ID: 35b308b173d9b0532f6cde55f5bface33093279d7ce3c78a2cc6db588f634b90
                                                          • Opcode Fuzzy Hash: 6989041179a6ec659f8410a82a3610e1053cc9f4ca9d652552d89decbf4b4a90
                                                          • Instruction Fuzzy Hash: 6CA002B1945620DBFE429BE08D9EF1B3B25E748781F01C040E315641BCCA754010DF39
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Non-executed Functions

                                                          Function 0040488F Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMONCrypto
                                                          Download Yara Rule
                                                          C-Code - Quality: 96%
                                                          			E0040488F(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				signed char* _v28;
				long _v32;
				signed int _v40;
				int _v44;
				signed int* _v56;
				signed char* _v60;
				signed int _v64;
				long _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t192;
				int _t194;
				intOrPtr _t195;
				intOrPtr _t197;
				long _t201;
				signed int _t205;
				signed int _t216;
				void* _t219;
				void* _t220;
				int _t226;
				signed int _t231;
				signed int _t232;
				signed int _t233;
				signed int _t239;
				signed int _t241;
				signed char _t242;
				signed char _t248;
				void* _t252;
				void* _t254;
				signed char* _t270;
				signed char _t271;
				long _t273;
				long _t276;
				int _t277;
				int _t282;
				signed int _t283;
				long _t284;
				signed int _t287;
				signed int _t294;
				int _t295;
				int _t296;
				signed char* _t302;
				struct HWND__* _t306;
				int _t307;
				signed int* _t308;
				int _t309;
				long _t310;
				signed int _t311;
				void* _t313;
				long _t314;
				int _t315;
				signed int _t316;
				void* _t318;

				_t306 = _a4;
				_v12 = GetDlgItem(_t306, 0x3f9);
				_v8 = GetDlgItem(_t306, 0x408);
				_t318 = SendMessageA;
				_v20 =  *0x423728;
				_t282 = 0;
				_v24 =  *0x423710 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t285 = _a16;
					} else {
						_a12 = _t282;
						_t285 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t285;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t285 + 4)) == 0x408) {
							if(( *0x423719 & 0x00000002) != 0) {
								L41:
								if(_v16 != _t282) {
									_t231 = _v16;
									if( *((intOrPtr*)(_t231 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, _t282,  *(_t231 + 0x5c));
									}
									_t232 = _v16;
									if( *((intOrPtr*)(_t232 + 8)) == 0xfffffe6a) {
										_t285 = _v20;
										_t233 =  *(_t232 + 0x5c);
										if( *((intOrPtr*)(_t232 + 0xc)) != 2) {
											 *(_t233 * 0x418 + _t285 + 8) =  *(_t233 * 0x418 + _t285 + 8) & 0xffffffdf;
										} else {
											 *(_t233 * 0x418 + _t285 + 8) =  *(_t233 * 0x418 + _t285 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t285 = 0 | _a8 != 0x00000413;
								_t239 = E004047DD(_v8, _a8 != 0x413);
								_t311 = _t239;
								if(_t311 >= _t282) {
									_t88 = _v20 + 8; // 0x8
									_t285 = _t239 * 0x418 + _t88;
									_t241 =  *_t285;
									if((_t241 & 0x00000010) == 0) {
										if((_t241 & 0x00000040) == 0) {
											_t242 = _t241 ^ 0x00000001;
										} else {
											_t248 = _t241 ^ 0x00000080;
											if(_t248 >= 0) {
												_t242 = _t248 & 0x000000fe;
											} else {
												_t242 = _t248 | 0x00000001;
											}
										}
										 *_t285 = _t242;
										E0040117D(_t311);
										_a12 = _t311 + 1;
										_a16 =  !( *0x423718) >> 0x00000008 & 0x00000001;
										_a8 = 0x40f;
									}
								}
								goto L41;
							}
							_t285 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageA(_v8, 0x200, _t282, _t282);
							}
							if(_a8 == 0x40b) {
								_t219 =  *0x41fcec; // 0x0
								if(_t219 != _t282) {
									ImageList_Destroy(_t219);
								}
								_t220 =  *0x41fd00; // 0x0
								if(_t220 != _t282) {
									GlobalFree(_t220);
								}
								 *0x41fcec = _t282;
								 *0x41fd00 = _t282;
								 *0x423760 = _t282;
							}
							if(_a8 != 0x40f) {
								L88:
								if(_a8 == 0x420 && ( *0x423719 & 0x00000001) != 0) {
									_t307 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t307);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t307);
								}
								goto L91;
							} else {
								E004011EF(_t285, _t282, _t282);
								_t192 = _a12;
								if(_t192 != _t282) {
									if(_t192 != 0xffffffff) {
										_t192 = _t192 - 1;
									}
									_push(_t192);
									_push(8);
									E0040485D();
								}
								if(_a16 == _t282) {
									L75:
									E004011EF(_t285, _t282, _t282);
									_t194 =  *0x41fd00; // 0x0
									_v32 = _t194;
									_t195 =  *0x423728;
									_v60 = 0xf030;
									_v20 = _t282;
									if( *0x42372c <= _t282) {
										L86:
										InvalidateRect(_v8, _t282, 1);
										_t197 =  *0x422edc; // 0x5fcb61
										if( *((intOrPtr*)(_t197 + 0x10)) != _t282) {
											E00404798(0x3ff, 0xfffffffb, E004047B0(5));
										}
										goto L88;
									}
									_t308 = _t195 + 8;
									do {
										_t201 =  *((intOrPtr*)(_v32 + _v20 * 4));
										if(_t201 != _t282) {
											_t287 =  *_t308;
											_v68 = _t201;
											_v72 = 8;
											if((_t287 & 0x00000001) != 0) {
												_v72 = 9;
												_v56 =  &(_t308[4]);
												_t308[0] = _t308[0] & 0x000000fe;
											}
											if((_t287 & 0x00000040) == 0) {
												_t205 = (_t287 & 0x00000001) + 1;
												if((_t287 & 0x00000010) != 0) {
													_t205 = _t205 + 3;
												}
											} else {
												_t205 = 3;
											}
											_v64 = (_t205 << 0x0000000b | _t287 & 0x00000008) + (_t205 << 0x0000000b | _t287 & 0x00000008) | _t287 & 0x00000020;
											SendMessageA(_v8, 0x1102, (_t287 >> 0x00000005 & 0x00000001) + 1, _v68);
											SendMessageA(_v8, 0x110d, _t282,  &_v72);
										}
										_v20 = _v20 + 1;
										_t308 =  &(_t308[0x106]);
									} while (_v20 <  *0x42372c);
									goto L86;
								} else {
									_t309 = E004012E2( *0x41fd00);
									E00401299(_t309);
									_t216 = 0;
									_t285 = 0;
									if(_t309 <= _t282) {
										L74:
										SendMessageA(_v12, 0x14e, _t285, _t282);
										_a16 = _t309;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v24 + _t216 * 4)) != _t282) {
											_t285 = _t285 + 1;
										}
										_t216 = _t216 + 1;
									} while (_t216 < _t309);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L91;
						} else {
							_t226 = SendMessageA(_v12, 0x147, _t282, _t282);
							if(_t226 == 0xffffffff) {
								goto L91;
							}
							_t310 = SendMessageA(_v12, 0x150, _t226, _t282);
							if(_t310 == 0xffffffff ||  *((intOrPtr*)(_v24 + _t310 * 4)) == _t282) {
								_t310 = 0x20;
							}
							E00401299(_t310);
							SendMessageA(_a4, 0x420, _t282, _t310);
							_a12 = _a12 | 0xffffffff;
							_a16 = _t282;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					_v32 = 0;
					_v16 = 2;
					 *0x423760 = _t306;
					 *0x41fd00 = GlobalAlloc(0x40,  *0x42372c << 2);
					_t252 = LoadBitmapA( *0x423700, 0x6e);
					 *0x41fcf4 =  *0x41fcf4 | 0xffffffff;
					_t313 = _t252;
					 *0x41fcfc = SetWindowLongA(_v8, 0xfffffffc, E00404E86);
					_t254 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x41fcec = _t254;
					ImageList_AddMasked(_t254, _t313, 0xff00ff);
					SendMessageA(_v8, 0x1109, 2,  *0x41fcec);
					if(SendMessageA(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageA(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_t313);
					_t314 = 0;
					do {
						_t260 =  *((intOrPtr*)(_v24 + _t314 * 4));
						if( *((intOrPtr*)(_v24 + _t314 * 4)) != _t282) {
							if(_t314 != 0x20) {
								_v16 = _t282;
							}
							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, _t282, E00405D1B(_t282, _t314, _t318, _t282, _t260)), _t314);
						}
						_t314 = _t314 + 1;
					} while (_t314 < 0x21);
					_t315 = _a16;
					_t283 = _v16;
					_push( *((intOrPtr*)(_t315 + 0x30 + _t283 * 4)));
					_push(0x15);
					E00403EDE(_a4);
					_push( *((intOrPtr*)(_t315 + 0x34 + _t283 * 4)));
					_push(0x16);
					E00403EDE(_a4);
					_t316 = 0;
					_t284 = 0;
					if( *0x42372c <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t302 = _v20 + 8;
						_v28 = _t302;
						do {
							_t270 =  &(_t302[0x10]);
							if( *_t270 != 0) {
								_v60 = _t270;
								_t271 =  *_t302;
								_t294 = 0x20;
								_v84 = _t284;
								_v80 = 0xffff0002;
								_v76 = 0xd;
								_v64 = _t294;
								_v40 = _t316;
								_v68 = _t271 & _t294;
								if((_t271 & 0x00000002) == 0) {
									if((_t271 & 0x00000004) == 0) {
										_t273 = SendMessageA(_v8, 0x1100, 0,  &_v84);
										_t295 =  *0x41fd00; // 0x0
										 *(_t295 + _t316 * 4) = _t273;
									} else {
										_t284 = SendMessageA(_v8, 0x110a, 3, _t284);
									}
								} else {
									_v76 = 0x4d;
									_v44 = 1;
									_t276 = SendMessageA(_v8, 0x1100, 0,  &_v84);
									_t296 =  *0x41fd00; // 0x0
									_v32 = 1;
									 *(_t296 + _t316 * 4) = _t276;
									_t277 =  *0x41fd00; // 0x0
									_t284 =  *(_t277 + _t316 * 4);
								}
							}
							_t316 = _t316 + 1;
							_t302 =  &(_v28[0x418]);
							_v28 = _t302;
						} while (_t316 <  *0x42372c);
						if(_v32 != 0) {
							L20:
							if(_v16 != 0) {
								E00403F13(_v8);
								_t282 = 0;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00403F13(_v12);
								L91:
								return E00403F45(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}


































































                                                          0x0040489e
                                                          0x004048af
                                                          0x004048b4
                                                          0x004048bc
                                                          0x004048c2
                                                          0x004048ca
                                                          0x004048d8
                                                          0x004048db
                                                          0x00404afb
                                                          0x00404b02
                                                          0x00404b16
                                                          0x00404b04
                                                          0x00404b06
                                                          0x00404b09
                                                          0x00404b0a
                                                          0x00404b11
                                                          0x00404b11
                                                          0x00404b22
                                                          0x00404b30
                                                          0x00404b33
                                                          0x00404b49
                                                          0x00404bbe
                                                          0x00404bc1
                                                          0x00404bc3
                                                          0x00404bcd
                                                          0x00404bdb
                                                          0x00404bdb
                                                          0x00404bdd
                                                          0x00404be7
                                                          0x00404bed
                                                          0x00404bf0
                                                          0x00404bf3
                                                          0x00404c0e
                                                          0x00404bf5
                                                          0x00404bff
                                                          0x00404bff
                                                          0x00404bf3
                                                          0x00404be7
                                                          0x00000000
                                                          0x00404bc1
                                                          0x00404b4e
                                                          0x00404b59
                                                          0x00404b5e
                                                          0x00404b65
                                                          0x00404b6a
                                                          0x00404b6e
                                                          0x00404b79
                                                          0x00404b79
                                                          0x00404b7d
                                                          0x00404b81
                                                          0x00404b85
                                                          0x00404b98
                                                          0x00404b87
                                                          0x00404b87
                                                          0x00404b8e
                                                          0x00404b94
                                                          0x00404b90
                                                          0x00404b90
                                                          0x00404b90
                                                          0x00404b8e
                                                          0x00404b9c
                                                          0x00404b9e
                                                          0x00404bb1
                                                          0x00404bb4
                                                          0x00404bb7
                                                          0x00404bb7
                                                          0x00404b81
                                                          0x00000000
                                                          0x00404b6e
                                                          0x00404b50
                                                          0x00404b57
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00404c11
                                                          0x00404c11
                                                          0x00404c18
                                                          0x00404c89
                                                          0x00404c91
                                                          0x00404c99
                                                          0x00404c99
                                                          0x00404ca2
                                                          0x00404ca4
                                                          0x00404cab
                                                          0x00404cae
                                                          0x00404cae
                                                          0x00404cb4
                                                          0x00404cbb
                                                          0x00404cbe
                                                          0x00404cbe
                                                          0x00404cc4
                                                          0x00404cca
                                                          0x00404cd0
                                                          0x00404cd0
                                                          0x00404cdd
                                                          0x00404e33
                                                          0x00404e3a
                                                          0x00404e57
                                                          0x00404e5d
                                                          0x00404e6f
                                                          0x00404e6f
                                                          0x00000000
                                                          0x00404ce3
                                                          0x00404ce5
                                                          0x00404cea
                                                          0x00404cef
                                                          0x00404cf4
                                                          0x00404cf6
                                                          0x00404cf6
                                                          0x00404cf7
                                                          0x00404cf8
                                                          0x00404cfa
                                                          0x00404cfa
                                                          0x00404d02
                                                          0x00404d43
                                                          0x00404d45
                                                          0x00404d4a
                                                          0x00404d55
                                                          0x00404d58
                                                          0x00404d5d
                                                          0x00404d64
                                                          0x00404d67
                                                          0x00404e09
                                                          0x00404e0f
                                                          0x00404e15
                                                          0x00404e1d
                                                          0x00404e2e
                                                          0x00404e2e
                                                          0x00000000
                                                          0x00404e1d
                                                          0x00404d6d
                                                          0x00404d70
                                                          0x00404d76
                                                          0x00404d7b
                                                          0x00404d7d
                                                          0x00404d7f
                                                          0x00404d85
                                                          0x00404d8c
                                                          0x00404d91
                                                          0x00404d98
                                                          0x00404d9b
                                                          0x00404d9b
                                                          0x00404da2
                                                          0x00404dae
                                                          0x00404db2
                                                          0x00404db4
                                                          0x00404db4
                                                          0x00404da4
                                                          0x00404da6
                                                          0x00404da6
                                                          0x00404dd4
                                                          0x00404de0
                                                          0x00404def
                                                          0x00404def
                                                          0x00404df1
                                                          0x00404df4
                                                          0x00404dfd
                                                          0x00000000
                                                          0x00404d04
                                                          0x00404d0f
                                                          0x00404d12
                                                          0x00404d17
                                                          0x00404d19
                                                          0x00404d1d
                                                          0x00404d2d
                                                          0x00404d37
                                                          0x00404d39
                                                          0x00404d3c
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00404d1f
                                                          0x00404d1f
                                                          0x00404d25
                                                          0x00404d27
                                                          0x00404d27
                                                          0x00404d28
                                                          0x00404d29
                                                          0x00000000
                                                          0x00404d1f
                                                          0x00404d02
                                                          0x00404cdd
                                                          0x00404c20
                                                          0x00000000
                                                          0x00404c36
                                                          0x00404c40
                                                          0x00404c45
                                                          0x00000000
                                                          0x00000000
                                                          0x00404c57
                                                          0x00404c5c
                                                          0x00404c68
                                                          0x00404c68
                                                          0x00404c6a
                                                          0x00404c79
                                                          0x00404c7b
                                                          0x00404c7f
                                                          0x00404c82
                                                          0x00000000
                                                          0x00404c82
                                                          0x00404c20
                                                          0x004048e1
                                                          0x004048e6
                                                          0x004048ef
                                                          0x004048f6
                                                          0x00404904
                                                          0x0040490f
                                                          0x00404915
                                                          0x00404923
                                                          0x00404937
                                                          0x0040493c
                                                          0x00404949
                                                          0x0040494e
                                                          0x00404964
                                                          0x00404975
                                                          0x00404982
                                                          0x00404982
                                                          0x00404985
                                                          0x0040498b
                                                          0x0040498d
                                                          0x00404990
                                                          0x00404995
                                                          0x0040499a
                                                          0x0040499c
                                                          0x0040499c
                                                          0x004049bc
                                                          0x004049bc
                                                          0x004049be
                                                          0x004049bf
                                                          0x004049c4
                                                          0x004049c7
                                                          0x004049ca
                                                          0x004049ce
                                                          0x004049d3
                                                          0x004049d8
                                                          0x004049dc
                                                          0x004049e1
                                                          0x004049e6
                                                          0x004049e8
                                                          0x004049f0
                                                          0x00404aba
                                                          0x00404acd
                                                          0x00000000
                                                          0x004049f6
                                                          0x004049f9
                                                          0x004049fc
                                                          0x004049ff
                                                          0x004049ff
                                                          0x00404a05
                                                          0x00404a0b
                                                          0x00404a0e
                                                          0x00404a14
                                                          0x00404a15
                                                          0x00404a1a
                                                          0x00404a23
                                                          0x00404a2a
                                                          0x00404a2d
                                                          0x00404a30
                                                          0x00404a33
                                                          0x00404a6f
                                                          0x00404a90
                                                          0x00404a92
                                                          0x00404a98
                                                          0x00404a71
                                                          0x00404a7e
                                                          0x00404a7e
                                                          0x00404a35
                                                          0x00404a38
                                                          0x00404a47
                                                          0x00404a51
                                                          0x00404a53
                                                          0x00404a59
                                                          0x00404a60
                                                          0x00404a63
                                                          0x00404a68
                                                          0x00404a68
                                                          0x00404a33
                                                          0x00404a9e
                                                          0x00404a9f
                                                          0x00404aab
                                                          0x00404aab
                                                          0x00404ab8
                                                          0x00404ad3
                                                          0x00404ad7
                                                          0x00404af4
                                                          0x00404af9
                                                          0x00000000
                                                          0x00404ad9
                                                          0x00404ade
                                                          0x00404ae7
                                                          0x00404e71
                                                          0x00404e83
                                                          0x00404e83
                                                          0x00404ad7
                                                          0x00000000
                                                          0x00404ab8
                                                          0x004049f0

                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                          • String ID: $M$N
                                                          • API String ID: 1638840714-813528018
                                                          • Opcode ID: 740ea71b6102a598a93b05621d95f64ff88d0dc0fa76445e6ba636445e9306ed
                                                          • Instruction ID: e7c54df8ad39b376662a796d960b289492e5a6982c1727c2c37b81bede79f7f2
                                                          • Opcode Fuzzy Hash: 740ea71b6102a598a93b05621d95f64ff88d0dc0fa76445e6ba636445e9306ed
                                                          • Instruction Fuzzy Hash: 43025EB0A00209AFEF109F54DC85AAE7BB5FB84315F10817AF611B62E1D7789E42DF58
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040431C Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 78%
                                                          			E0040431C(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				CHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				CHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				signed char* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed char _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				CHAR* _t146;
				intOrPtr _t147;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed char* _t160;
				struct HWND__* _t165;
				struct HWND__* _t166;
				int _t168;
				unsigned int _t197;
				void* _t205;

				_t156 = __edx;
				_t82 =  *0x41f4e0; // 0x5f90ec
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xa) + 0x424000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E004054D3(0x3fb, _t146);
					E00405F64(_t146);
				}
				_t166 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E004054D3(0x3fb, _t146);
							if(E00405859(_t185, _t146) == 0) {
								_v8 = 1;
							}
							E00405CF9(0x41ecd8, _t146);
							_t87 = E00406092(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E00405CF9(0x41ecd8, _t146);
								_t89 = E00405804(0x41ecd8);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 =  *_t89 & 0x00000000;
								}
								if(GetDiskFreeSpaceA(0x41ecd8,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t168 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x41ecd8) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x41ecd8,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E004057B2(0x41ecd8);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160 - 1;
									 *_t159 = 0x5c;
									if(_t159 != 0x41ecd8) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t168 = 0x400;
								L36:
								_t95 = E004047B0(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								_t147 =  *0x422edc; // 0x5fcb61
								if( *((intOrPtr*)(_t147 + 0x10)) != _t158) {
									E00404798(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextA(_a4, _t168, 0x41ecc8);
									} else {
										E004046D3(_t168, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x4237a4 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t168) != 0) {
									_v8 = _t158;
								}
								E00403F00(0 | _v8 == _t158);
								if(_v8 == _t158) {
									_t205 =  *0x41fcf8 - _t158; // 0x0
									if(_t205 == 0) {
										E004042B1();
									}
								}
								 *0x41fcf8 = _t158;
								goto L53;
							}
						}
						_t185 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t166;
							_v72 = 0x41fd08;
							_v60 = E0040466D;
							_v56 = _t146;
							_v68 = E00405D1B(_t146, 0x41fd08, _t166, 0x41f0e0, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderA(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E0040576B(_t146);
								_t125 =  *((intOrPtr*)( *0x423710 + 0x11c));
								if( *((intOrPtr*)( *0x423710 + 0x11c)) != 0 && _t146 == "C:\\Users\\hardz\\Pacifisterne\\Automatcafeer") {
									E00405D1B(_t146, 0x41fd08, _t166, 0, _t125);
									if(lstrcmpiA(0x4226a0, 0x41fd08) != 0) {
										lstrcatA(_t146, 0x4226a0);
									}
								}
								 *0x41fcf8 =  *0x41fcf8 + 1;
								SetDlgItemTextA(_t166, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					} else {
						_a8 = 0x40f;
						goto L12;
					}
				} else {
					_t165 = GetDlgItem(_t166, 0x3fb);
					if(E004057D8(_t146) != 0 && E00405804(_t146) == 0) {
						E0040576B(_t146);
					}
					 *0x422ed8 = _t166;
					SetWindowTextA(_t165, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00403EDE(_t166);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00403EDE(_t166);
					E00403F13(_t165);
					_t138 = E00406092(6);
					if(_t138 == 0) {
						L53:
						return E00403F45(_a8, _a12, _a16);
					} else {
						 *_t138(_t165, 1);
						goto L8;
					}
				}
			}















































                                                          0x0040431c
                                                          0x00404322
                                                          0x00404328
                                                          0x00404335
                                                          0x00404343
                                                          0x00404346
                                                          0x0040434e
                                                          0x00404354
                                                          0x00404354
                                                          0x00404360
                                                          0x00404363
                                                          0x004043d1
                                                          0x004043d8
                                                          0x004044af
                                                          0x004044b6
                                                          0x004044c5
                                                          0x004044c5
                                                          0x004044c9
                                                          0x004044d3
                                                          0x004044e0
                                                          0x004044e2
                                                          0x004044e2
                                                          0x004044f0
                                                          0x004044f7
                                                          0x004044fe
                                                          0x00404501
                                                          0x00404538
                                                          0x0040453a
                                                          0x00404540
                                                          0x00404545
                                                          0x00404549
                                                          0x0040454b
                                                          0x0040454b
                                                          0x00404567
                                                          0x00000000
                                                          0x00404569
                                                          0x0040456c
                                                          0x0040457a
                                                          0x00404580
                                                          0x00404581
                                                          0x00404584
                                                          0x00404587
                                                          0x00000000
                                                          0x00404587
                                                          0x00404503
                                                          0x00404505
                                                          0x00404509
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040450b
                                                          0x0040450b
                                                          0x00404518
                                                          0x0040451d
                                                          0x00000000
                                                          0x00000000
                                                          0x00404521
                                                          0x00404523
                                                          0x00404523
                                                          0x0040452b
                                                          0x0040452d
                                                          0x00404530
                                                          0x00404533
                                                          0x00404536
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00404536
                                                          0x00404593
                                                          0x0040459d
                                                          0x004045a0
                                                          0x004045a3
                                                          0x004045aa
                                                          0x004045aa
                                                          0x004045ac
                                                          0x004045ac
                                                          0x004045b1
                                                          0x004045b3
                                                          0x004045bb
                                                          0x004045c2
                                                          0x004045c4
                                                          0x004045cf
                                                          0x004045cf
                                                          0x004045c4
                                                          0x004045d6
                                                          0x004045df
                                                          0x004045e9
                                                          0x004045f1
                                                          0x0040460c
                                                          0x004045f3
                                                          0x004045fc
                                                          0x004045fc
                                                          0x004045f1
                                                          0x00404611
                                                          0x00404616
                                                          0x0040461b
                                                          0x00404624
                                                          0x00404624
                                                          0x0040462d
                                                          0x0040462f
                                                          0x0040462f
                                                          0x0040463b
                                                          0x00404643
                                                          0x00404645
                                                          0x0040464b
                                                          0x0040464d
                                                          0x0040464d
                                                          0x0040464b
                                                          0x00404652
                                                          0x00000000
                                                          0x00404652
                                                          0x00404501
                                                          0x004044b8
                                                          0x004044bf
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x004044bf
                                                          0x004043de
                                                          0x004043e7
                                                          0x00404401
                                                          0x00404406
                                                          0x00404410
                                                          0x00404417
                                                          0x00404423
                                                          0x00404426
                                                          0x00404429
                                                          0x00404430
                                                          0x00404438
                                                          0x0040443b
                                                          0x0040443f
                                                          0x00404446
                                                          0x0040444e
                                                          0x004044a8
                                                          0x00404450
                                                          0x00404451
                                                          0x00404458
                                                          0x00404462
                                                          0x0040446a
                                                          0x00404477
                                                          0x0040448b
                                                          0x0040448f
                                                          0x0040448f
                                                          0x0040448b
                                                          0x00404494
                                                          0x004044a1
                                                          0x004044a1
                                                          0x0040444e
                                                          0x00000000
                                                          0x00404406
                                                          0x004043f4
                                                          0x00000000
                                                          0x004043fa
                                                          0x004043fa
                                                          0x00000000
                                                          0x004043fa
                                                          0x00404365
                                                          0x00404372
                                                          0x0040437b
                                                          0x00404388
                                                          0x00404388
                                                          0x0040438f
                                                          0x00404395
                                                          0x0040439e
                                                          0x004043a1
                                                          0x004043a4
                                                          0x004043ac
                                                          0x004043af
                                                          0x004043b2
                                                          0x004043b8
                                                          0x004043bf
                                                          0x004043c6
                                                          0x00404658
                                                          0x0040466a
                                                          0x004043cc
                                                          0x004043cf
                                                          0x00000000
                                                          0x004043cf
                                                          0x004043c6

                                                          APIs
                                                          • GetDlgItem.USER32 ref: 0040436B
                                                          • SetWindowTextA.USER32(00000000,?), ref: 00404395
                                                          • SHBrowseForFolderA.SHELL32(?,0041F0E0,?), ref: 00404446
                                                          • CoTaskMemFree.OLE32(00000000), ref: 00404451
                                                          • lstrcmpiA.KERNEL32(Call,Staalbrylluppets Setup: Installing,00000000,?,?), ref: 00404483
                                                          • lstrcatA.KERNEL32(?,Call), ref: 0040448F
                                                          • SetDlgItemTextA.USER32 ref: 004044A1
                                                            • Part of subcall function 004054D3: GetDlgItemTextA.USER32 ref: 004054E6
                                                            • Part of subcall function 00405F64: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe",74D0FA90,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FBC
                                                            • Part of subcall function 00405F64: CharNextA.USER32(?,?,?,00000000), ref: 00405FC9
                                                            • Part of subcall function 00405F64: CharNextA.USER32(?,"C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe",74D0FA90,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FCE
                                                            • Part of subcall function 00405F64: CharPrevA.USER32(?,?,74D0FA90,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FDE
                                                          • GetDiskFreeSpaceA.KERNEL32(0041ECD8,?,?,0000040F,?,0041ECD8,0041ECD8,?,00000001,0041ECD8,?,?,000003FB,?), ref: 0040455F
                                                          • MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040457A
                                                            • Part of subcall function 004046D3: lstrlenA.KERNEL32(Staalbrylluppets Setup: Installing,Staalbrylluppets Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004045EE,000000DF,00000000,00000400,?), ref: 00404771
                                                            • Part of subcall function 004046D3: wsprintfA.USER32 ref: 00404779
                                                            • Part of subcall function 004046D3: SetDlgItemTextA.USER32 ref: 0040478C
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                          • String ID: A$C:\Users\user\Pacifisterne\Automatcafeer$Call$Staalbrylluppets Setup: Installing
                                                          • API String ID: 2624150263-3254831034
                                                          • Opcode ID: 287a848f07727e5060837a884b3595807051cc28657a93d39b14e32bd715fa24
                                                          • Instruction ID: 222947b4accbc62cc0073c5541b0f9589876626f1104fcc3d8441c992cea6716
                                                          • Opcode Fuzzy Hash: 287a848f07727e5060837a884b3595807051cc28657a93d39b14e32bd715fa24
                                                          • Instruction Fuzzy Hash: 71A17EB1900209ABDB11AFA5CC45BEFB6B8EF84315F14843BF711B62D1D77C8A418B69
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 10001A5D Relevance: 20.0, APIs: 13, Instructions: 540stringmemoryCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 95%
                                                          			E10001A5D() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				CHAR* _v24;
				CHAR* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				CHAR* _v44;
				signed int _v48;
				void* _v52;
				intOrPtr _v56;
				CHAR* _t198;
				signed int _t201;
				void* _t203;
				void* _t205;
				CHAR* _t207;
				void* _t215;
				struct HINSTANCE__* _t216;
				struct HINSTANCE__* _t217;
				struct HINSTANCE__* _t219;
				signed short _t221;
				struct HINSTANCE__* _t224;
				struct HINSTANCE__* _t226;
				void* _t227;
				char* _t228;
				void* _t239;
				signed char _t240;
				signed int _t241;
				struct HINSTANCE__* _t247;
				void* _t248;
				signed int _t250;
				signed int _t252;
				signed int _t258;
				void* _t259;
				signed int _t262;
				signed int _t265;
				signed int _t266;
				signed int _t271;
				signed int _t272;
				signed int _t273;
				signed int _t274;
				void* _t277;
				void* _t281;
				struct HINSTANCE__* _t283;
				signed char _t286;
				void _t287;
				signed int _t288;
				signed int _t300;
				signed int _t301;
				signed char _t307;
				signed int _t308;
				CHAR* _t309;
				CHAR* _t311;
				CHAR* _t312;
				struct HINSTANCE__* _t313;
				void* _t315;
				signed int _t316;
				void* _t317;

				_t283 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				_v8 = 0;
				_v40 = 0;
				_t317 = 0;
				_v48 = 0;
				_t198 = E10001215();
				_v24 = _t198;
				_v28 = _t198;
				_v44 = E10001215();
				_t308 = E1000123B();
				_v52 = _t308;
				_v12 = _t308;
				while(1) {
					_t201 = _v32;
					_v56 = _t201;
					if(_t201 != _t283 && _t317 == _t283) {
						break;
					}
					_t307 =  *_t308;
					_t286 = _t307;
					_t203 = _t286 - _t283;
					if(_t203 == 0) {
						_t33 =  &_v32;
						 *_t33 = _v32 | 0xffffffff;
						__eflags =  *_t33;
						L17:
						_t205 = _v56 - _t283;
						if(_t205 == 0) {
							 *_v28 =  *_v28 & 0x00000000;
							__eflags = _t317 - _t283;
							if(_t317 == _t283) {
								_t317 = GlobalAlloc(0x40, 0x14a4);
								 *(_t317 + 0x810) = _t283;
								 *(_t317 + 0x814) = _t283;
							}
							_t287 = _v36;
							_t43 = _t317 + 8; // 0x8
							_t207 = _t43;
							_t44 = _t317 + 0x408; // 0x408
							_t309 = _t44;
							 *_t317 = _t287;
							 *_t207 =  *_t207 & 0x00000000;
							 *(_t317 + 0x808) = _t283;
							 *_t309 =  *_t309 & 0x00000000;
							_t288 = _t287 - _t283;
							__eflags = _t288;
							 *(_t317 + 0x80c) = _t283;
							 *(_t317 + 4) = _t283;
							if(_t288 == 0) {
								__eflags = _v28 - _v24;
								if(_v28 == _v24) {
									goto L39;
								}
								_t315 = 0;
								GlobalFree(_t317);
								_t317 = E100012FE(_v24);
								__eflags = _t317 - _t283;
								if(_t317 == _t283) {
									goto L39;
								} else {
									goto L32;
								}
								while(1) {
									L32:
									_t239 =  *(_t317 + 0x14a0);
									__eflags = _t239 - _t283;
									if(_t239 == _t283) {
										break;
									}
									_t315 = _t317;
									_t317 = _t239;
									__eflags = _t317 - _t283;
									if(_t317 != _t283) {
										continue;
									}
									break;
								}
								__eflags = _t315 - _t283;
								if(_t315 != _t283) {
									 *(_t315 + 0x14a0) = _t283;
								}
								_t240 =  *(_t317 + 0x810);
								__eflags = _t240 & 0x00000008;
								if((_t240 & 0x00000008) == 0) {
									_t241 = _t240 | 0x00000002;
									__eflags = _t241;
									 *(_t317 + 0x810) = _t241;
								} else {
									_t317 = E10001534(_t317);
									 *(_t317 + 0x810) =  *(_t317 + 0x810) & 0xfffffff5;
								}
								goto L39;
							} else {
								_t300 = _t288 - 1;
								__eflags = _t300;
								if(_t300 == 0) {
									L28:
									lstrcpyA(_t207, _v44);
									L29:
									lstrcpyA(_t309, _v24);
									L39:
									_v12 = _v12 + 1;
									_v28 = _v24;
									L63:
									if(_v32 != 0xffffffff) {
										_t308 = _v12;
										continue;
									}
									break;
								}
								_t301 = _t300 - 1;
								__eflags = _t301;
								if(_t301 == 0) {
									goto L29;
								}
								__eflags = _t301 != 1;
								if(_t301 != 1) {
									goto L39;
								}
								goto L28;
							}
						}
						if(_t205 != 1) {
							goto L39;
						}
						_t247 = _v16;
						if(_v40 == _t283) {
							_t247 = _t247 - 1;
						}
						 *(_t317 + 0x814) = _t247;
						goto L39;
					}
					_t248 = _t203 - 0x23;
					if(_t248 == 0) {
						__eflags = _t308 - _v52;
						if(_t308 <= _v52) {
							L15:
							_v32 = _t283;
							_v36 = _t283;
							goto L17;
						}
						__eflags =  *((char*)(_t308 - 1)) - 0x3a;
						if( *((char*)(_t308 - 1)) != 0x3a) {
							goto L15;
						}
						__eflags = _v32 - _t283;
						if(_v32 == _t283) {
							L40:
							_t250 = _v32 - _t283;
							__eflags = _t250;
							if(_t250 == 0) {
								__eflags = _t307 - 0x2a;
								if(_t307 == 0x2a) {
									_v36 = 2;
									L61:
									_t308 = _v12;
									_v28 = _v24;
									_t283 = 0;
									__eflags = 0;
									L62:
									_t316 = _t308 + 1;
									__eflags = _t316;
									_v12 = _t316;
									goto L63;
								}
								__eflags = _t307 - 0x2d;
								if(_t307 == 0x2d) {
									L132:
									_t252 = _t308 + 1;
									__eflags =  *_t252 - 0x3e;
									if( *_t252 != 0x3e) {
										L134:
										_t252 = _t308 + 1;
										__eflags =  *_t252 - 0x3a;
										if( *_t252 != 0x3a) {
											L141:
											_v28 =  &(_v28[1]);
											 *_v28 = _t307;
											goto L62;
										}
										__eflags = _t307 - 0x2d;
										if(_t307 == 0x2d) {
											goto L141;
										}
										_v36 = 1;
										L137:
										_v12 = _t252;
										__eflags = _v28 - _v24;
										if(_v28 <= _v24) {
											 *_v44 =  *_v44 & 0x00000000;
										} else {
											 *_v28 =  *_v28 & 0x00000000;
											lstrcpyA(_v44, _v24);
										}
										goto L61;
									}
									_v36 = 3;
									goto L137;
								}
								__eflags = _t307 - 0x3a;
								if(_t307 != 0x3a) {
									goto L141;
								}
								__eflags = _t307 - 0x2d;
								if(_t307 != 0x2d) {
									goto L134;
								}
								goto L132;
							}
							_t258 = _t250 - 1;
							__eflags = _t258;
							if(_t258 == 0) {
								L74:
								_t259 = _t286 - 0x22;
								__eflags = _t259 - 0x55;
								if(_t259 > 0x55) {
									goto L61;
								}
								switch( *((intOrPtr*)(( *(_t259 + 0x1000215a) & 0x000000ff) * 4 +  &M100020F6))) {
									case 0:
										__eax = _v24;
										__edi = _v12;
										while(1) {
											__edi = __edi + 1;
											_v12 = __edi;
											__cl =  *__edi;
											__eflags = __cl - __dl;
											if(__cl != __dl) {
												goto L116;
											}
											L115:
											__eflags =  *(__edi + 1) - __dl;
											if( *(__edi + 1) != __dl) {
												L120:
												 *__eax =  *__eax & 0x00000000;
												__ebx = E10001224(_v24);
												goto L91;
											}
											L116:
											__eflags = __cl;
											if(__cl == 0) {
												goto L120;
											}
											__eflags = __cl - __dl;
											if(__cl == __dl) {
												__edi = __edi + 1;
												__eflags = __edi;
											}
											__cl =  *__edi;
											 *__eax =  *__edi;
											__eax = __eax + 1;
											__edi = __edi + 1;
											_v12 = __edi;
											__cl =  *__edi;
											__eflags = __cl - __dl;
											if(__cl != __dl) {
												goto L116;
											}
											goto L115;
										}
									case 1:
										_v8 = 1;
										goto L61;
									case 2:
										_v8 = _v8 | 0xffffffff;
										goto L61;
									case 3:
										_v8 = _v8 & 0x00000000;
										_v20 = _v20 & 0x00000000;
										_v16 = _v16 + 1;
										goto L79;
									case 4:
										__eflags = _v20;
										if(_v20 != 0) {
											goto L61;
										}
										_v12 = _v12 - 1;
										__ebx = E10001215();
										 &_v12 = E100019FB( &_v12);
										__eax = E10001429(__edx, __eax, __edx, __ebx);
										goto L91;
									case 5:
										L99:
										_v20 = _v20 + 1;
										goto L61;
									case 6:
										_push(7);
										goto L107;
									case 7:
										_push(0x19);
										goto L127;
									case 8:
										_push(0x15);
										goto L127;
									case 9:
										_push(0x16);
										goto L127;
									case 0xa:
										_push(0x18);
										goto L127;
									case 0xb:
										_push(5);
										goto L107;
									case 0xc:
										__eax = 0;
										__eax = 1;
										goto L85;
									case 0xd:
										_push(6);
										goto L107;
									case 0xe:
										_push(2);
										goto L107;
									case 0xf:
										_push(3);
										goto L107;
									case 0x10:
										_push(0x17);
										L127:
										_pop(__ebx);
										goto L92;
									case 0x11:
										__eax =  &_v12;
										__eax = E100019FB( &_v12);
										__ebx = __eax;
										__ebx = __eax + 1;
										__eflags = __ebx - 0xb;
										if(__ebx < 0xb) {
											__ebx = __ebx + 0xa;
										}
										goto L91;
									case 0x12:
										__ebx = 0xffffffff;
										goto L92;
									case 0x13:
										_v48 = _v48 + 1;
										_push(3);
										_pop(__eax);
										goto L85;
									case 0x14:
										__eax = 0;
										__eflags = 0;
										goto L85;
									case 0x15:
										_push(4);
										L107:
										_pop(__eax);
										L85:
										__edi = _v16;
										__ecx =  *(0x1000305c + __eax * 4);
										__edi = _v16 << 5;
										__edx = 0;
										__edi = (_v16 << 5) + __esi;
										__edx = 1;
										__eflags = _v8 - 0xffffffff;
										_v40 = 1;
										 *(__edi + 0x818) = __eax;
										if(_v8 == 0xffffffff) {
											L87:
											__ecx = __edx;
											L88:
											__eflags = _v8 - __edx;
											 *(__edi + 0x828) = __ecx;
											if(_v8 == __edx) {
												__eax =  &_v12;
												__eax = E100019FB( &_v12);
												__eax = __eax + 1;
												__eflags = __eax;
												_v8 = __eax;
											}
											__eax = _v8;
											 *((intOrPtr*)(__edi + 0x81c)) = _v8;
											_t133 = _v16 + 0x41; // 0x41
											_t133 = _t133 << 5;
											__eax = 0;
											__eflags = 0;
											 *((intOrPtr*)((_t133 << 5) + __esi)) = 0;
											 *((intOrPtr*)(__edi + 0x830)) = 0;
											 *((intOrPtr*)(__edi + 0x82c)) = 0;
											goto L91;
										}
										__eflags = __ecx;
										if(__ecx > 0) {
											goto L88;
										}
										goto L87;
									case 0x16:
										_t261 =  *(_t317 + 0x814);
										__eflags = _t261 - _v16;
										if(_t261 > _v16) {
											_v16 = _t261;
										}
										_v8 = _v8 & 0x00000000;
										_v20 = _v20 & 0x00000000;
										_v36 - 3 = _t261 - (_v36 == 3);
										if(_t261 != _v36 == 3) {
											L79:
											_v40 = 1;
										}
										goto L61;
									case 0x17:
										__eax =  &_v12;
										__eax = E100019FB( &_v12);
										__ebx = __eax;
										__ebx = __eax + 1;
										L91:
										__eflags = __ebx;
										if(__ebx == 0) {
											goto L61;
										}
										L92:
										__eflags = _v20;
										_v40 = 1;
										if(_v20 != 0) {
											L97:
											__eflags = _v20 - 1;
											if(_v20 == 1) {
												__eax = _v16;
												__eax = _v16 << 5;
												__eflags = __eax;
												 *(__eax + __esi + 0x82c) = __ebx;
											}
											goto L99;
										}
										_v16 = _v16 << 5;
										_t141 = __esi + 0x830; // 0x830
										__edi = (_v16 << 5) + _t141;
										__eax =  *__edi;
										__eflags = __eax - 0xffffffff;
										if(__eax <= 0xffffffff) {
											L95:
											__eax = GlobalFree(__eax);
											L96:
											 *__edi = __ebx;
											goto L97;
										}
										__eflags = __eax - 0x19;
										if(__eax <= 0x19) {
											goto L96;
										}
										goto L95;
									case 0x18:
										goto L61;
								}
							}
							_t262 = _t258 - 1;
							__eflags = _t262;
							if(_t262 == 0) {
								_v16 = _t283;
								goto L74;
							}
							__eflags = _t262 != 1;
							if(_t262 != 1) {
								goto L141;
							}
							_t265 = _t286 - 0x21;
							__eflags = _t265;
							if(_t265 == 0) {
								_v8 =  ~_v8;
								goto L61;
							}
							_t266 = _t265 - 0x42;
							__eflags = _t266;
							if(_t266 == 0) {
								L57:
								__eflags = _v8 - 1;
								if(_v8 != 1) {
									_t92 = _t317 + 0x810;
									 *_t92 =  *(_t317 + 0x810) &  !0x00000001;
									__eflags =  *_t92;
								} else {
									 *(_t317 + 0x810) =  *(_t317 + 0x810) | 1;
								}
								_v8 = 1;
								goto L61;
							}
							_t271 = _t266;
							__eflags = _t271;
							if(_t271 == 0) {
								_push(0x20);
								L56:
								_pop(1);
								goto L57;
							}
							_t272 = _t271 - 9;
							__eflags = _t272;
							if(_t272 == 0) {
								_push(8);
								goto L56;
							}
							_t273 = _t272 - 4;
							__eflags = _t273;
							if(_t273 == 0) {
								_push(4);
								goto L56;
							}
							_t274 = _t273 - 1;
							__eflags = _t274;
							if(_t274 == 0) {
								_push(0x10);
								goto L56;
							}
							__eflags = _t274 != 0;
							if(_t274 != 0) {
								goto L61;
							}
							_push(0x40);
							goto L56;
						}
						goto L15;
					}
					_t277 = _t248 - 5;
					if(_t277 == 0) {
						__eflags = _v36 - 3;
						_v32 = 1;
						_v8 = _t283;
						_v20 = _t283;
						_v16 = (0 | _v36 == 0x00000003) + 1;
						_v40 = _t283;
						goto L17;
					}
					_t281 = _t277 - 1;
					if(_t281 == 0) {
						_v32 = 2;
						_v8 = _t283;
						_v20 = _t283;
						goto L17;
					}
					if(_t281 != 0x16) {
						goto L40;
					} else {
						_v32 = 3;
						_v8 = 1;
						goto L17;
					}
				}
				GlobalFree(_v52);
				GlobalFree(_v24);
				GlobalFree(_v44);
				if(_t317 == _t283 ||  *(_t317 + 0x80c) != _t283) {
					L161:
					return _t317;
				} else {
					_t215 =  *_t317 - 1;
					if(_t215 == 0) {
						_t178 = _t317 + 8; // 0x8
						_t311 = _t178;
						__eflags =  *_t311;
						if( *_t311 != 0) {
							_t216 = GetModuleHandleA(_t311);
							__eflags = _t216 - _t283;
							 *(_t317 + 0x808) = _t216;
							if(_t216 != _t283) {
								L150:
								_t183 = _t317 + 0x408; // 0x408
								_t312 = _t183;
								_t217 = E100015A4( *(_t317 + 0x808), _t312);
								__eflags = _t217 - _t283;
								 *(_t317 + 0x80c) = _t217;
								if(_t217 == _t283) {
									__eflags =  *_t312 - 0x23;
									if( *_t312 == 0x23) {
										_t186 = _t317 + 0x409; // 0x409
										_t221 = E100012FE(_t186);
										__eflags = _t221 - _t283;
										if(_t221 != _t283) {
											__eflags = _t221 & 0xffff0000;
											if((_t221 & 0xffff0000) == 0) {
												 *(_t317 + 0x80c) = GetProcAddress( *(_t317 + 0x808), _t221 & 0x0000ffff);
											}
										}
									}
								}
								__eflags = _v48 - _t283;
								if(_v48 != _t283) {
									L157:
									_t312[lstrlenA(_t312)] = 0x41;
									_t219 = E100015A4( *(_t317 + 0x808), _t312);
									__eflags = _t219 - _t283;
									if(_t219 != _t283) {
										L145:
										 *(_t317 + 0x80c) = _t219;
										goto L161;
									}
									__eflags =  *(_t317 + 0x80c) - _t283;
									L159:
									if(__eflags != 0) {
										goto L161;
									}
									L160:
									_t196 = _t317 + 4;
									 *_t196 =  *(_t317 + 4) | 0xffffffff;
									__eflags =  *_t196;
									goto L161;
								} else {
									__eflags =  *(_t317 + 0x80c) - _t283;
									if( *(_t317 + 0x80c) != _t283) {
										goto L161;
									}
									goto L157;
								}
							}
							_t224 = LoadLibraryA(_t311);
							__eflags = _t224 - _t283;
							 *(_t317 + 0x808) = _t224;
							if(_t224 == _t283) {
								goto L160;
							}
							goto L150;
						}
						_t179 = _t317 + 0x408; // 0x408
						_t226 = E100012FE(_t179);
						 *(_t317 + 0x80c) = _t226;
						__eflags = _t226 - _t283;
						goto L159;
					}
					_t227 = _t215 - 1;
					if(_t227 == 0) {
						_t176 = _t317 + 0x408; // 0x408
						_t228 = _t176;
						__eflags =  *_t228;
						if( *_t228 == 0) {
							goto L161;
						}
						_t219 = E100012FE(_t228);
						L144:
						goto L145;
					}
					if(_t227 != 1) {
						goto L161;
					}
					_t80 = _t317 + 8; // 0x8
					_t284 = _t80;
					_t313 = E100012FE(_t80);
					 *(_t317 + 0x808) = _t313;
					if(_t313 == 0) {
						goto L160;
					}
					 *(_t317 + 0x84c) =  *(_t317 + 0x84c) & 0x00000000;
					 *((intOrPtr*)(_t317 + 0x850)) = E10001224(_t284);
					 *(_t317 + 0x83c) =  *(_t317 + 0x83c) & 0x00000000;
					 *((intOrPtr*)(_t317 + 0x848)) = 1;
					 *((intOrPtr*)(_t317 + 0x838)) = 1;
					_t89 = _t317 + 0x408; // 0x408
					_t219 =  *(_t313->i + E100012FE(_t89) * 4);
					goto L144;
				}
			}































































                                                          0x10001a65
                                                          0x10001a68
                                                          0x10001a6b
                                                          0x10001a6e
                                                          0x10001a71
                                                          0x10001a74
                                                          0x10001a77
                                                          0x10001a79
                                                          0x10001a7c
                                                          0x10001a81
                                                          0x10001a84
                                                          0x10001a8c
                                                          0x10001a94
                                                          0x10001a96
                                                          0x10001a99
                                                          0x10001aa1
                                                          0x10001aa1
                                                          0x10001aa6
                                                          0x10001aa9
                                                          0x00000000
                                                          0x00000000
                                                          0x10001ab3
                                                          0x10001ab5
                                                          0x10001aba
                                                          0x10001abc
                                                          0x10001b2e
                                                          0x10001b2e
                                                          0x10001b2e
                                                          0x10001b32
                                                          0x10001b35
                                                          0x10001b37
                                                          0x10001b59
                                                          0x10001b5c
                                                          0x10001b5e
                                                          0x10001b6d
                                                          0x10001b6f
                                                          0x10001b75
                                                          0x10001b75
                                                          0x10001b7b
                                                          0x10001b7e
                                                          0x10001b7e
                                                          0x10001b81
                                                          0x10001b81
                                                          0x10001b87
                                                          0x10001b89
                                                          0x10001b8c
                                                          0x10001b92
                                                          0x10001b95
                                                          0x10001b95
                                                          0x10001b97
                                                          0x10001b9d
                                                          0x10001ba0
                                                          0x10001bc4
                                                          0x10001bc7
                                                          0x00000000
                                                          0x00000000
                                                          0x10001bca
                                                          0x10001bcc
                                                          0x10001bda
                                                          0x10001bdd
                                                          0x10001bdf
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x10001be1
                                                          0x10001be1
                                                          0x10001be1
                                                          0x10001be7
                                                          0x10001be9
                                                          0x00000000
                                                          0x00000000
                                                          0x10001beb
                                                          0x10001bed
                                                          0x10001bef
                                                          0x10001bf1
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x10001bf1
                                                          0x10001bf3
                                                          0x10001bf5
                                                          0x10001bf7
                                                          0x10001bf7
                                                          0x10001bfd
                                                          0x10001c03
                                                          0x10001c05
                                                          0x10001c19
                                                          0x10001c19
                                                          0x10001c1b
                                                          0x10001c07
                                                          0x10001c0d
                                                          0x10001c10
                                                          0x10001c10
                                                          0x00000000
                                                          0x10001ba2
                                                          0x10001ba2
                                                          0x10001ba2
                                                          0x10001ba3
                                                          0x10001bab
                                                          0x10001baf
                                                          0x10001bb5
                                                          0x10001bb9
                                                          0x10001c21
                                                          0x10001c24
                                                          0x10001c27
                                                          0x10001cb1
                                                          0x10001cb5
                                                          0x10001a9e
                                                          0x00000000
                                                          0x10001a9e
                                                          0x00000000
                                                          0x10001cb5
                                                          0x10001ba5
                                                          0x10001ba5
                                                          0x10001ba6
                                                          0x00000000
                                                          0x00000000
                                                          0x10001ba8
                                                          0x10001ba9
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x10001ba9
                                                          0x10001ba0
                                                          0x10001b3a
                                                          0x00000000
                                                          0x00000000
                                                          0x10001b43
                                                          0x10001b46
                                                          0x10001b53
                                                          0x10001b53
                                                          0x10001b48
                                                          0x00000000
                                                          0x10001b48
                                                          0x10001abe
                                                          0x10001ac1
                                                          0x10001b12
                                                          0x10001b15
                                                          0x10001b26
                                                          0x10001b26
                                                          0x10001b29
                                                          0x00000000
                                                          0x10001b29
                                                          0x10001b17
                                                          0x10001b1b
                                                          0x00000000
                                                          0x00000000
                                                          0x10001b1d
                                                          0x10001b20
                                                          0x10001c2f
                                                          0x10001c32
                                                          0x10001c32
                                                          0x10001c34
                                                          0x10001f7a
                                                          0x10001f7d
                                                          0x10001fe0
                                                          0x10001ca2
                                                          0x10001ca5
                                                          0x10001ca8
                                                          0x10001cab
                                                          0x10001cab
                                                          0x10001cad
                                                          0x10001cad
                                                          0x10001cad
                                                          0x10001cae
                                                          0x00000000
                                                          0x10001cae
                                                          0x10001f7f
                                                          0x10001f82
                                                          0x10001f8e
                                                          0x10001f8e
                                                          0x10001f91
                                                          0x10001f94
                                                          0x10001f9f
                                                          0x10001f9f
                                                          0x10001fa2
                                                          0x10001fa5
                                                          0x10001fec
                                                          0x10001fef
                                                          0x10001ff2
                                                          0x00000000
                                                          0x10001ff2
                                                          0x10001fa7
                                                          0x10001faa
                                                          0x00000000
                                                          0x00000000
                                                          0x10001fac
                                                          0x10001fb3
                                                          0x10001fb3
                                                          0x10001fb9
                                                          0x10001fbc
                                                          0x10001fd8
                                                          0x10001fbe
                                                          0x10001fc7
                                                          0x10001fca
                                                          0x10001fca
                                                          0x00000000
                                                          0x10001fbc
                                                          0x10001f96
                                                          0x00000000
                                                          0x10001f96
                                                          0x10001f84
                                                          0x10001f87
                                                          0x00000000
                                                          0x00000000
                                                          0x10001f89
                                                          0x10001f8c
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x10001f8c
                                                          0x10001c3a
                                                          0x10001c3a
                                                          0x10001c3b
                                                          0x10001d6a
                                                          0x10001d6a
                                                          0x10001d6f
                                                          0x10001d72
                                                          0x00000000
                                                          0x00000000
                                                          0x10001d7f
                                                          0x00000000
                                                          0x10001f22
                                                          0x10001f25
                                                          0x10001f28
                                                          0x10001f28
                                                          0x10001f29
                                                          0x10001f2c
                                                          0x10001f2e
                                                          0x10001f30
                                                          0x00000000
                                                          0x00000000
                                                          0x10001f32
                                                          0x10001f32
                                                          0x10001f35
                                                          0x10001f47
                                                          0x10001f4a
                                                          0x10001f53
                                                          0x00000000
                                                          0x10001f53
                                                          0x10001f37
                                                          0x10001f37
                                                          0x10001f39
                                                          0x00000000
                                                          0x00000000
                                                          0x10001f3b
                                                          0x10001f3d
                                                          0x10001f3f
                                                          0x10001f3f
                                                          0x10001f3f
                                                          0x10001f40
                                                          0x10001f42
                                                          0x10001f44
                                                          0x10001f28
                                                          0x10001f29
                                                          0x10001f2c
                                                          0x10001f2e
                                                          0x10001f30
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x10001f30
                                                          0x00000000
                                                          0x10001dc6
                                                          0x00000000
                                                          0x00000000
                                                          0x10001dd2
                                                          0x00000000
                                                          0x00000000
                                                          0x10001db9
                                                          0x10001dbd
                                                          0x10001dc1
                                                          0x00000000
                                                          0x00000000
                                                          0x10001ef4
                                                          0x10001ef8
                                                          0x00000000
                                                          0x00000000
                                                          0x10001efe
                                                          0x10001f06
                                                          0x10001f0d
                                                          0x10001f15
                                                          0x00000000
                                                          0x00000000
                                                          0x10001e91
                                                          0x10001e91
                                                          0x00000000
                                                          0x00000000
                                                          0x10001ddb
                                                          0x00000000
                                                          0x00000000
                                                          0x10001f72
                                                          0x00000000
                                                          0x00000000
                                                          0x10001f62
                                                          0x00000000
                                                          0x00000000
                                                          0x10001f66
                                                          0x00000000
                                                          0x00000000
                                                          0x10001f6e
                                                          0x00000000
                                                          0x00000000
                                                          0x10001eb4
                                                          0x00000000
                                                          0x00000000
                                                          0x10001e99
                                                          0x10001e9b
                                                          0x00000000
                                                          0x00000000
                                                          0x10001ebc
                                                          0x00000000
                                                          0x00000000
                                                          0x10001ea1
                                                          0x00000000
                                                          0x00000000
                                                          0x10001ea5
                                                          0x00000000
                                                          0x00000000
                                                          0x10001f6a
                                                          0x10001f74
                                                          0x10001f74
                                                          0x00000000
                                                          0x00000000
                                                          0x10001ec4
                                                          0x10001ec8
                                                          0x10001ecd
                                                          0x10001ed0
                                                          0x10001ed1
                                                          0x10001ed4
                                                          0x10001eda
                                                          0x10001eda
                                                          0x00000000
                                                          0x00000000
                                                          0x10001f5a
                                                          0x00000000
                                                          0x00000000
                                                          0x10001ea9
                                                          0x10001eac
                                                          0x10001eae
                                                          0x00000000
                                                          0x00000000
                                                          0x10001de2
                                                          0x10001de2
                                                          0x00000000
                                                          0x00000000
                                                          0x10001eb8
                                                          0x10001ebe
                                                          0x10001ebe
                                                          0x10001de4
                                                          0x10001de4
                                                          0x10001de7
                                                          0x10001dee
                                                          0x10001df1
                                                          0x10001df3
                                                          0x10001df5
                                                          0x10001df6
                                                          0x10001dfa
                                                          0x10001dfd
                                                          0x10001e03
                                                          0x10001e09
                                                          0x10001e09
                                                          0x10001e0b
                                                          0x10001e0b
                                                          0x10001e0e
                                                          0x10001e14
                                                          0x10001e16
                                                          0x10001e1a
                                                          0x10001e1f
                                                          0x10001e1f
                                                          0x10001e21
                                                          0x10001e21
                                                          0x10001e24
                                                          0x10001e27
                                                          0x10001e30
                                                          0x10001e33
                                                          0x10001e36
                                                          0x10001e36
                                                          0x10001e38
                                                          0x10001e3b
                                                          0x10001e41
                                                          0x00000000
                                                          0x10001e41
                                                          0x10001e05
                                                          0x10001e07
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x10001d86
                                                          0x10001d8c
                                                          0x10001d8f
                                                          0x10001d91
                                                          0x10001d91
                                                          0x10001d94
                                                          0x10001d98
                                                          0x10001da5
                                                          0x10001da7
                                                          0x10001dad
                                                          0x10001dad
                                                          0x10001dad
                                                          0x00000000
                                                          0x00000000
                                                          0x10001ee2
                                                          0x10001ee6
                                                          0x10001eeb
                                                          0x10001eee
                                                          0x10001e47
                                                          0x10001e47
                                                          0x10001e49
                                                          0x00000000
                                                          0x00000000
                                                          0x10001e4f
                                                          0x10001e4f
                                                          0x10001e53
                                                          0x10001e5a
                                                          0x10001e7e
                                                          0x10001e7e
                                                          0x10001e82
                                                          0x10001e84
                                                          0x10001e87
                                                          0x10001e87
                                                          0x10001e8a
                                                          0x10001e8a
                                                          0x00000000
                                                          0x10001e82
                                                          0x10001e5f
                                                          0x10001e62
                                                          0x10001e62
                                                          0x10001e69
                                                          0x10001e6b
                                                          0x10001e6e
                                                          0x10001e75
                                                          0x10001e76
                                                          0x10001e7c
                                                          0x10001e7c
                                                          0x00000000
                                                          0x10001e7c
                                                          0x10001e70
                                                          0x10001e73
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x10001d7f
                                                          0x10001c41
                                                          0x10001c41
                                                          0x10001c42
                                                          0x10001d67
                                                          0x00000000
                                                          0x10001d67
                                                          0x10001c48
                                                          0x10001c49
                                                          0x00000000
                                                          0x00000000
                                                          0x10001c51
                                                          0x10001c51
                                                          0x10001c54
                                                          0x10001c9f
                                                          0x00000000
                                                          0x10001c9f
                                                          0x10001c56
                                                          0x10001c56
                                                          0x10001c59
                                                          0x10001c83
                                                          0x10001c86
                                                          0x10001c89
                                                          0x10001d59
                                                          0x10001d59
                                                          0x10001d59
                                                          0x10001c8f
                                                          0x10001c8f
                                                          0x10001c8f
                                                          0x10001d5f
                                                          0x00000000
                                                          0x10001d5f
                                                          0x10001c5c
                                                          0x10001c5c
                                                          0x10001c5d
                                                          0x10001c80
                                                          0x10001c82
                                                          0x10001c82
                                                          0x00000000
                                                          0x10001c82
                                                          0x10001c5f
                                                          0x10001c5f
                                                          0x10001c62
                                                          0x10001c7c
                                                          0x00000000
                                                          0x10001c7c
                                                          0x10001c64
                                                          0x10001c64
                                                          0x10001c67
                                                          0x10001c78
                                                          0x00000000
                                                          0x10001c78
                                                          0x10001c69
                                                          0x10001c69
                                                          0x10001c6a
                                                          0x10001c74
                                                          0x00000000
                                                          0x10001c74
                                                          0x10001c6d
                                                          0x10001c6e
                                                          0x00000000
                                                          0x00000000
                                                          0x10001c70
                                                          0x00000000
                                                          0x10001c70
                                                          0x00000000
                                                          0x10001b20
                                                          0x10001ac3
                                                          0x10001ac6
                                                          0x10001af5
                                                          0x10001af9
                                                          0x10001b00
                                                          0x10001b07
                                                          0x10001b0a
                                                          0x10001b0d
                                                          0x00000000
                                                          0x10001b0d
                                                          0x10001ac8
                                                          0x10001ac9
                                                          0x10001ae4
                                                          0x10001aeb
                                                          0x10001aee
                                                          0x00000000
                                                          0x10001aee
                                                          0x10001ace
                                                          0x00000000
                                                          0x10001ad4
                                                          0x10001ad4
                                                          0x10001adb
                                                          0x00000000
                                                          0x10001adb
                                                          0x10001ace
                                                          0x10001cc4
                                                          0x10001cc9
                                                          0x10001cce
                                                          0x10001cd2
                                                          0x100020ef
                                                          0x100020f5
                                                          0x10001ce4
                                                          0x10001ce6
                                                          0x10001ce7
                                                          0x1000201a
                                                          0x1000201a
                                                          0x1000201d
                                                          0x10002020
                                                          0x1000203d
                                                          0x10002043
                                                          0x10002045
                                                          0x1000204b
                                                          0x10002062
                                                          0x10002062
                                                          0x10002062
                                                          0x1000206f
                                                          0x10002075
                                                          0x10002078
                                                          0x1000207e
                                                          0x10002080
                                                          0x10002083
                                                          0x10002085
                                                          0x1000208c
                                                          0x10002091
                                                          0x10002094
                                                          0x10002096
                                                          0x1000209b
                                                          0x100020ad
                                                          0x100020ad
                                                          0x1000209b
                                                          0x10002094
                                                          0x10002083
                                                          0x100020b3
                                                          0x100020b6
                                                          0x100020c0
                                                          0x100020c8
                                                          0x100020d4
                                                          0x100020da
                                                          0x100020dd
                                                          0x1000200f
                                                          0x1000200f
                                                          0x00000000
                                                          0x1000200f
                                                          0x100020e3
                                                          0x100020e9
                                                          0x100020e9
                                                          0x00000000
                                                          0x00000000
                                                          0x100020eb
                                                          0x100020eb
                                                          0x100020eb
                                                          0x100020eb
                                                          0x00000000
                                                          0x100020b8
                                                          0x100020b8
                                                          0x100020be
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x100020be
                                                          0x100020b6
                                                          0x1000204e
                                                          0x10002054
                                                          0x10002056
                                                          0x1000205c
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x1000205c
                                                          0x10002022
                                                          0x10002029
                                                          0x1000202f
                                                          0x10002035
                                                          0x00000000
                                                          0x10002035
                                                          0x10001ced
                                                          0x10001cee
                                                          0x10001ff9
                                                          0x10001ff9
                                                          0x10001fff
                                                          0x10002002
                                                          0x00000000
                                                          0x00000000
                                                          0x10002009
                                                          0x1000200e
                                                          0x00000000
                                                          0x1000200e
                                                          0x10001cf5
                                                          0x00000000
                                                          0x00000000
                                                          0x10001cfb
                                                          0x10001cfb
                                                          0x10001d04
                                                          0x10001d09
                                                          0x10001d0f
                                                          0x00000000
                                                          0x00000000
                                                          0x10001d15
                                                          0x10001d22
                                                          0x10001d28
                                                          0x10001d32
                                                          0x10001d38
                                                          0x10001d40
                                                          0x10001d50
                                                          0x00000000
                                                          0x10001d50

                                                          APIs
                                                            • Part of subcall function 10001215: GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D
                                                          • GlobalAlloc.KERNEL32(00000040,000014A4), ref: 10001B67
                                                          • lstrcpyA.KERNEL32(00000008,?), ref: 10001BAF
                                                          • lstrcpyA.KERNEL32(00000408,?), ref: 10001BB9
                                                          • GlobalFree.KERNEL32 ref: 10001BCC
                                                          • GlobalFree.KERNEL32 ref: 10001CC4
                                                          • GlobalFree.KERNEL32 ref: 10001CC9
                                                          • GlobalFree.KERNEL32 ref: 10001CCE
                                                          • GlobalFree.KERNEL32 ref: 10001E76
                                                          • lstrcpyA.KERNEL32(?,?), ref: 10001FCA
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.524434554.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.524374525.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          • Associated: 00000000.00000002.524488197.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          • Associated: 00000000.00000002.524503265.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Global$Free$lstrcpy$Alloc
                                                          • String ID:
                                                          • API String ID: 4227406936-0
                                                          • Opcode ID: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
                                                          • Instruction ID: 780798ea066e4ece118e8e5fed0bf18c828ec290136deaf2e43fc5d0554b8685
                                                          • Opcode Fuzzy Hash: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
                                                          • Instruction Fuzzy Hash: 17129971D0424ADFFB20CFA4C8847EEBBF4FB043C4F61852AD5A1A2199DB749A81CB51
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040205E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 74%
                                                          			E0040205E() {
				signed int _t55;
				void* _t59;
				intOrPtr* _t63;
				intOrPtr _t64;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t73;
				intOrPtr* _t75;
				intOrPtr* _t78;
				intOrPtr* _t80;
				intOrPtr* _t82;
				intOrPtr* _t84;
				int _t87;
				intOrPtr* _t95;
				signed int _t105;
				signed int _t109;
				void* _t111;

				 *(_t111 - 0x34) = E00402A3A(0xfffffff0);
				 *(_t111 - 0xc) = E00402A3A(0xffffffdf);
				 *((intOrPtr*)(_t111 - 0x4c)) = E00402A3A(2);
				 *((intOrPtr*)(_t111 - 0x40)) = E00402A3A(0xffffffcd);
				 *((intOrPtr*)(_t111 - 0x38)) = E00402A3A(0x45);
				_t55 =  *(_t111 - 0x18);
				 *(_t111 - 0x44) = _t55 & 0x00000fff;
				_t105 = _t55 & 0x00008000;
				_t109 = _t55 >> 0x0000000c & 0x00000007;
				 *(_t111 - 0x3c) = _t55 >> 0x00000010 & 0x0000ffff;
				if(E004057D8( *(_t111 - 0xc)) == 0) {
					E00402A3A(0x21);
				}
				_t59 = _t111 + 8;
				__imp__CoCreateInstance(0x407408, _t87, 1, 0x4073f8, _t59);
				if(_t59 < _t87) {
					L15:
					 *((intOrPtr*)(_t111 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t63 =  *((intOrPtr*)(_t111 + 8));
					_t64 =  *((intOrPtr*)( *_t63))(_t63, 0x407418, _t111 - 0x30);
					 *((intOrPtr*)(_t111 - 8)) = _t64;
					if(_t64 >= _t87) {
						_t67 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)(_t111 - 8)) =  *((intOrPtr*)( *_t67 + 0x50))(_t67,  *(_t111 - 0xc));
						if(_t105 == _t87) {
							_t84 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t84 + 0x24))(_t84, "C:\\Users\\hardz\\Pacifisterne\\Automatcafeer\\Syntaksgenkendelsernes\\Temposkifterne");
						}
						if(_t109 != _t87) {
							_t82 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t82 + 0x3c))(_t82, _t109);
						}
						_t69 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t69 + 0x34))(_t69,  *(_t111 - 0x3c));
						_t95 =  *((intOrPtr*)(_t111 - 0x40));
						if( *_t95 != _t87) {
							_t80 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t80 + 0x44))(_t80, _t95,  *(_t111 - 0x44));
						}
						_t71 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t71 + 0x2c))(_t71,  *((intOrPtr*)(_t111 - 0x4c)));
						_t73 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t73 + 0x1c))(_t73,  *((intOrPtr*)(_t111 - 0x38)));
						if( *((intOrPtr*)(_t111 - 8)) >= _t87) {
							 *((intOrPtr*)(_t111 - 8)) = 0x80004005;
							if(MultiByteToWideChar(_t87, _t87,  *(_t111 - 0x34), 0xffffffff,  *(_t111 - 0xc), 0x400) != 0) {
								_t78 =  *((intOrPtr*)(_t111 - 0x30));
								 *((intOrPtr*)(_t111 - 8)) =  *((intOrPtr*)( *_t78 + 0x18))(_t78,  *(_t111 - 0xc), 1);
							}
						}
						_t75 =  *((intOrPtr*)(_t111 - 0x30));
						 *((intOrPtr*)( *_t75 + 8))(_t75);
					}
					_t65 =  *((intOrPtr*)(_t111 + 8));
					 *((intOrPtr*)( *_t65 + 8))(_t65);
					if( *((intOrPtr*)(_t111 - 8)) >= _t87) {
						_push(0xfffffff4);
					} else {
						goto L15;
					}
				}
				E00401423();
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t111 - 4));
				return 0;
			}






















                                                          0x00402067
                                                          0x00402071
                                                          0x0040207b
                                                          0x00402085
                                                          0x00402090
                                                          0x00402093
                                                          0x004020ad
                                                          0x004020b0
                                                          0x004020b6
                                                          0x004020b9
                                                          0x004020c3
                                                          0x004020c7
                                                          0x004020c7
                                                          0x004020cc
                                                          0x004020dd
                                                          0x004020e5
                                                          0x004021bb
                                                          0x004021bb
                                                          0x004021c2
                                                          0x004020eb
                                                          0x004020eb
                                                          0x004020fa
                                                          0x004020fe
                                                          0x00402101
                                                          0x00402107
                                                          0x00402115
                                                          0x00402118
                                                          0x0040211a
                                                          0x00402125
                                                          0x00402125
                                                          0x0040212a
                                                          0x0040212c
                                                          0x00402133
                                                          0x00402133
                                                          0x00402136
                                                          0x0040213f
                                                          0x00402142
                                                          0x00402147
                                                          0x00402149
                                                          0x00402153
                                                          0x00402153
                                                          0x00402156
                                                          0x0040215f
                                                          0x00402162
                                                          0x0040216b
                                                          0x00402171
                                                          0x00402178
                                                          0x00402191
                                                          0x00402193
                                                          0x004021a1
                                                          0x004021a1
                                                          0x00402191
                                                          0x004021a4
                                                          0x004021aa
                                                          0x004021aa
                                                          0x004021ad
                                                          0x004021b3
                                                          0x004021b9
                                                          0x004021ce
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x004021b9
                                                          0x004021c4
                                                          0x004028d2
                                                          0x004028de

                                                          APIs
                                                          • CoCreateInstance.OLE32(00407408,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020DD
                                                          • MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402189
                                                          Strings
                                                          • C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne, xrefs: 0040211D
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: ByteCharCreateInstanceMultiWide
                                                          • String ID: C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne
                                                          • API String ID: 123533781-1980816760
                                                          • Opcode ID: 98c6856de954bf32f67bc9aae575288044ef0a57168b27d926b9bae310f30c25
                                                          • Instruction ID: 15b8319daa3a69dadbe16bc3493db081a7dc62ee607a685d27ecc12527328b4b
                                                          • Opcode Fuzzy Hash: 98c6856de954bf32f67bc9aae575288044ef0a57168b27d926b9bae310f30c25
                                                          • Instruction Fuzzy Hash: 785138B1A00208BFCF10DFA4C988A9D7BB5FF48319F20856AF515EB2D1DB799941CB54
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00402688 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 39%
                                                          			E00402688(char __ebx, char* __edi, char* __esi) {
				void* _t19;

				if(FindFirstFileA(E00402A3A(2), _t19 - 0x1a4) != 0xffffffff) {
					E00405C57(__edi, _t6);
					_push(_t19 - 0x178);
					_push(__esi);
					E00405CF9();
				} else {
					 *__edi = __ebx;
					 *__esi = __ebx;
					 *((intOrPtr*)(_t19 - 4)) = 1;
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}




                                                          0x004026a0
                                                          0x004026b4
                                                          0x004026bf
                                                          0x004026c0
                                                          0x004027f5
                                                          0x004026a2
                                                          0x004026a2
                                                          0x004026a4
                                                          0x004026a6
                                                          0x004026a6
                                                          0x004028d2
                                                          0x004028de

                                                          APIs
                                                          • FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402697
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: FileFindFirst
                                                          • String ID:
                                                          • API String ID: 1974802433-0
                                                          • Opcode ID: a8d2051a0b43e45e0548476364d3f5ec7a3e7dc7c9238cb7b637b6be69fa9f30
                                                          • Instruction ID: a95b2630499809d01a6e7b037cab792d100f7a465f9f887e4e98b5ff960ae470
                                                          • Opcode Fuzzy Hash: a8d2051a0b43e45e0548476364d3f5ec7a3e7dc7c9238cb7b637b6be69fa9f30
                                                          • Instruction Fuzzy Hash: 79F0A7726082009BE701E7A49949AEE7778DB61314F60057BE241A21C1D7B84985AB3A
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00404027 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 205windowstringCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 94%
                                                          			E00404027(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				char* _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t103;
				signed int _t106;
				intOrPtr _t107;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L11:
						__eflags = _a8 - 0x4e;
						if(_a8 != 0x4e) {
							__eflags = _a8 - 0x40b;
							if(_a8 == 0x40b) {
								 *0x41ecd4 =  *0x41ecd4 + 1;
								__eflags =  *0x41ecd4;
							}
							L25:
							_t110 = _a16;
							L26:
							return E00403F45(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						__eflags =  *((intOrPtr*)(_t110 + 8)) - 0x70b;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b) {
							__eflags =  *((intOrPtr*)(_t110 + 0xc)) - 0x201;
							if( *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
								_t100 =  *((intOrPtr*)(_t110 + 0x1c));
								_t109 =  *((intOrPtr*)(_t110 + 0x18));
								_v12 = _t100;
								__eflags = _t100 - _t109 - 0x800;
								_v16 = _t109;
								_v8 = 0x4226a0;
								if(_t100 - _t109 < 0x800) {
									SendMessageA(_t52, 0x44b, 0,  &_v16);
									SetCursor(LoadCursorA(0, 0x7f02));
									ShellExecuteA(_a4, "open", _v8, 0, 0, 1);
									SetCursor(LoadCursorA(0, 0x7f00));
									_t110 = _a16;
								}
							}
						}
						__eflags =  *((intOrPtr*)(_t110 + 8)) - 0x700;
						if( *((intOrPtr*)(_t110 + 8)) != 0x700) {
							goto L26;
						} else {
							__eflags =  *((intOrPtr*)(_t110 + 0xc)) - 0x100;
							if( *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
								goto L26;
							}
							__eflags =  *((intOrPtr*)(_t110 + 0x10)) - 0xd;
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x423708, 0x111, 1, 0);
							}
							__eflags =  *((intOrPtr*)(_t110 + 0x10)) - 0x1b;
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x423708, 0x10, 0, 0);
							}
							return 1;
						}
					}
					__eflags = _a12 >> 0x10;
					if(_a12 >> 0x10 != 0) {
						goto L25;
					}
					__eflags =  *0x41ecd4; // 0x0
					if(__eflags != 0) {
						goto L25;
					}
					_t103 =  *0x41f4e0; // 0x5f90ec
					_t25 = _t103 + 0x14; // 0x5f9100
					_t112 = _t25;
					__eflags =  *_t112 & 0x00000020;
					if(( *_t112 & 0x00000020) == 0) {
						goto L25;
					}
					_t106 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
					__eflags = _t106;
					 *_t112 = _t106;
					E00403F00(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
					E004042B1();
					goto L11;
				} else {
					_t98 = _a16;
					_t113 =  *(_t98 + 0x30);
					if(_t113 < 0) {
						_t107 =  *0x422edc; // 0x5fcb61
						_t113 =  *(_t107 - 4 + _t113 * 4);
					}
					_push( *((intOrPtr*)(_t98 + 0x34)));
					_t114 = _t113 +  *0x423738;
					_push(0x22);
					_a16 =  *_t114;
					_v12 = _v12 & 0x00000000;
					_t115 = _t114 + 1;
					_v16 = _t115;
					_v8 = E00403FF2;
					E00403EDE(_a4);
					_push( *((intOrPtr*)(_t98 + 0x38)));
					_push(0x23);
					E00403EDE(_a4);
					CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
					E00403F00( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
					_t99 = GetDlgItem(_a4, 0x3e8);
					E00403F13(_t99);
					SendMessageA(_t99, 0x45b, 1, 0);
					_t86 =  *( *0x423710 + 0x68);
					if(_t86 < 0) {
						_t86 = GetSysColor( ~_t86);
					}
					SendMessageA(_t99, 0x443, 0, _t86);
					SendMessageA(_t99, 0x445, 0, 0x4010000);
					SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
					 *0x41ecd4 = 0;
					SendMessageA(_t99, 0x449, _a16,  &_v16);
					 *0x41ecd4 = 0;
					return 0;
				}
			}




















                                                          0x00404037
                                                          0x00404149
                                                          0x0040415c
                                                          0x004041b8
                                                          0x004041b8
                                                          0x004041bc
                                                          0x0040428c
                                                          0x00404293
                                                          0x00404295
                                                          0x00404295
                                                          0x00404295
                                                          0x0040429b
                                                          0x0040429b
                                                          0x0040429e
                                                          0x00000000
                                                          0x004042a5
                                                          0x004041ca
                                                          0x004041cc
                                                          0x004041cf
                                                          0x004041d6
                                                          0x004041d8
                                                          0x004041df
                                                          0x004041e1
                                                          0x004041e4
                                                          0x004041e7
                                                          0x004041ec
                                                          0x004041f2
                                                          0x004041f5
                                                          0x004041fc
                                                          0x0040420a
                                                          0x00404222
                                                          0x00404235
                                                          0x00404245
                                                          0x00404247
                                                          0x00404247
                                                          0x004041fc
                                                          0x004041df
                                                          0x0040424a
                                                          0x00404251
                                                          0x00000000
                                                          0x00404253
                                                          0x00404253
                                                          0x0040425a
                                                          0x00000000
                                                          0x00000000
                                                          0x0040425c
                                                          0x00404260
                                                          0x00404271
                                                          0x00404271
                                                          0x00404273
                                                          0x00404277
                                                          0x00404285
                                                          0x00404285
                                                          0x00000000
                                                          0x00404289
                                                          0x00404251
                                                          0x00404164
                                                          0x00404167
                                                          0x00000000
                                                          0x00000000
                                                          0x0040416f
                                                          0x00404175
                                                          0x00000000
                                                          0x00000000
                                                          0x0040417b
                                                          0x00404181
                                                          0x00404181
                                                          0x00404184
                                                          0x00404187
                                                          0x00000000
                                                          0x00000000
                                                          0x004041aa
                                                          0x004041aa
                                                          0x004041ac
                                                          0x004041ae
                                                          0x004041b3
                                                          0x00000000
                                                          0x0040403d
                                                          0x0040403d
                                                          0x00404040
                                                          0x00404045
                                                          0x00404047
                                                          0x00404056
                                                          0x00404056
                                                          0x0040405d
                                                          0x00404060
                                                          0x00404062
                                                          0x00404067
                                                          0x00404070
                                                          0x00404076
                                                          0x00404082
                                                          0x00404085
                                                          0x0040408e
                                                          0x00404093
                                                          0x00404096
                                                          0x0040409b
                                                          0x004040b2
                                                          0x004040b9
                                                          0x004040cc
                                                          0x004040cf
                                                          0x004040e4
                                                          0x004040eb
                                                          0x004040f0
                                                          0x004040f5
                                                          0x004040f5
                                                          0x00404104
                                                          0x00404113
                                                          0x00404125
                                                          0x0040412a
                                                          0x0040413a
                                                          0x0040413c
                                                          0x00000000
                                                          0x00404142

                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
                                                          • String ID: Call$N$open
                                                          • API String ID: 3615053054-2563687911
                                                          • Opcode ID: d6331d360d592cb1fcb1934a6ab791839a151b05b6f3426df7f2f496f579edd7
                                                          • Instruction ID: f5dd8c80699fee66c1c508087d6ededbe7bbcdfb93c9c5870bdb982cd402330a
                                                          • Opcode Fuzzy Hash: d6331d360d592cb1fcb1934a6ab791839a151b05b6f3426df7f2f496f579edd7
                                                          • Instruction Fuzzy Hash: 1261C5B1A40209BFEB109F61DC45F6A7B79FB84741F10807AFB057A2D1C7B8A951CB98
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 90%
                                                          			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x423710;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, 0x422f00, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x423708;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}













                                                          0x0040100a
                                                          0x00401039
                                                          0x00401047
                                                          0x0040104d
                                                          0x00401051
                                                          0x0040105b
                                                          0x00401061
                                                          0x00401064
                                                          0x004010f3
                                                          0x00401089
                                                          0x0040108c
                                                          0x004010a6
                                                          0x004010bd
                                                          0x004010cc
                                                          0x004010cf
                                                          0x004010d5
                                                          0x004010d9
                                                          0x004010e4
                                                          0x004010ed
                                                          0x004010ef
                                                          0x004010ef
                                                          0x00401100
                                                          0x00401105
                                                          0x0040110d
                                                          0x00401110
                                                          0x00401112
                                                          0x00401118
                                                          0x0040111f
                                                          0x00401126
                                                          0x00401130
                                                          0x00401142
                                                          0x00401156
                                                          0x00401160
                                                          0x00401165
                                                          0x00401165
                                                          0x00401110
                                                          0x0040116e
                                                          0x00000000
                                                          0x00401178
                                                          0x00401010
                                                          0x00401013
                                                          0x00401015
                                                          0x0040101f
                                                          0x0040101f
                                                          0x00000000

                                                          APIs
                                                          • DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
                                                          • BeginPaint.USER32(?,?), ref: 00401047
                                                          • GetClientRect.USER32 ref: 0040105B
                                                          • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                          • FillRect.USER32 ref: 004010E4
                                                          • DeleteObject.GDI32(?), ref: 004010ED
                                                          • CreateFontIndirectA.GDI32(?), ref: 00401105
                                                          • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                          • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                          • SelectObject.GDI32(00000000,?), ref: 00401140
                                                          • DrawTextA.USER32(00000000,00422F00,000000FF,00000010,00000820), ref: 00401156
                                                          • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                          • DeleteObject.GDI32(?), ref: 00401165
                                                          • EndPaint.USER32(?,?), ref: 0040116E
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                          • String ID: F
                                                          • API String ID: 941294808-1304234792
                                                          • Opcode ID: c0f94b8c962ee7b75acafc3cefd778743504d8a107dd351fe724bfdc705f9f00
                                                          • Instruction ID: a0b7ce50fec83efafeb16569406a1c152c04985fcf8b97c7298fc3655e55bd79
                                                          • Opcode Fuzzy Hash: c0f94b8c962ee7b75acafc3cefd778743504d8a107dd351fe724bfdc705f9f00
                                                          • Instruction Fuzzy Hash: CD419B71804249AFCF058FA4CD459AFBFB9FF44310F00812AF961AA1A0C738EA50DFA5
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00405A42 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00405A42(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t13;
				long _t25;
				char* _t32;
				int _t38;
				void* _t39;
				intOrPtr* _t40;
				long _t43;
				CHAR* _t45;
				void* _t47;
				void* _t49;
				void* _t50;
				void* _t53;
				void* _t54;

				_t39 = __ecx;
				lstrcpyA(0x421a98, "NUL");
				_t45 =  *(_t53 + 0x18);
				if(_t45 == 0) {
					L3:
					_t13 = GetShortPathNameA( *(_t53 + 0x1c), 0x421e98, 0x400);
					if(_t13 != 0 && _t13 <= 0x400) {
						_t38 = wsprintfA(0x421698, "%s=%s\r\n", 0x421a98, 0x421e98);
						_t54 = _t53 + 0x10;
						E00405D1B(_t38, 0x421a98, 0x421e98, 0x421e98,  *((intOrPtr*)( *0x423710 + 0x128)));
						_t13 = E0040596C(0x421e98, 0xc0000000, 4);
						_t49 = _t13;
						 *(_t54 + 0x18) = _t49;
						if(_t49 != 0xffffffff) {
							_t43 = GetFileSize(_t49, 0);
							_t6 = _t38 + 0xa; // 0xa
							_t47 = GlobalAlloc(0x40, _t43 + _t6);
							if(_t47 == 0 || E004059E4(_t49, _t47, _t43) == 0) {
								L18:
								return CloseHandle(_t49);
							} else {
								if(E004058D1(_t39, _t47, "[Rename]\r\n") != 0) {
									_t50 = E004058D1(_t39, _t22 + 0xa, 0x4093b0);
									if(_t50 == 0) {
										_t49 =  *(_t54 + 0x18);
										L16:
										_t25 = _t43;
										L17:
										E00405927(_t25 + _t47, 0x421698, _t38);
										SetFilePointer(_t49, 0, 0, 0);
										E00405A13(_t49, _t47, _t43 + _t38);
										GlobalFree(_t47);
										goto L18;
									}
									_t40 = _t47 + _t43;
									_t32 = _t40 + _t38;
									while(_t40 > _t50) {
										 *_t32 =  *_t40;
										_t32 = _t32 - 1;
										_t40 = _t40 - 1;
									}
									_t25 = _t50 - _t47 + 1;
									_t49 =  *(_t54 + 0x18);
									goto L17;
								}
								lstrcpyA(_t47 + _t43, "[Rename]\r\n");
								_t43 = _t43 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E0040596C(_t45, 0, 1));
					_t13 = GetShortPathNameA(_t45, 0x421a98, 0x400);
					if(_t13 != 0 && _t13 <= 0x400) {
						goto L3;
					}
				}
				return _t13;
			}



















                                                          0x00405a42
                                                          0x00405a51
                                                          0x00405a57
                                                          0x00405a68
                                                          0x00405a90
                                                          0x00405a9b
                                                          0x00405a9f
                                                          0x00405abf
                                                          0x00405ac6
                                                          0x00405ad0
                                                          0x00405add
                                                          0x00405ae2
                                                          0x00405ae7
                                                          0x00405aeb
                                                          0x00405afa
                                                          0x00405afc
                                                          0x00405b09
                                                          0x00405b0d
                                                          0x00405ba8
                                                          0x00000000
                                                          0x00405b23
                                                          0x00405b30
                                                          0x00405b54
                                                          0x00405b58
                                                          0x00405b77
                                                          0x00405b7b
                                                          0x00405b7b
                                                          0x00405b7d
                                                          0x00405b86
                                                          0x00405b91
                                                          0x00405b9c
                                                          0x00405ba2
                                                          0x00000000
                                                          0x00405ba2
                                                          0x00405b5a
                                                          0x00405b5d
                                                          0x00405b68
                                                          0x00405b64
                                                          0x00405b66
                                                          0x00405b67
                                                          0x00405b67
                                                          0x00405b6f
                                                          0x00405b71
                                                          0x00000000
                                                          0x00405b71
                                                          0x00405b3b
                                                          0x00405b41
                                                          0x00000000
                                                          0x00405b41
                                                          0x00405b0d
                                                          0x00405aeb
                                                          0x00405a6a
                                                          0x00405a75
                                                          0x00405a7e
                                                          0x00405a82
                                                          0x00000000
                                                          0x00000000
                                                          0x00405a82
                                                          0x00405bb3

                                                          APIs
                                                          • lstrcpyA.KERNEL32(00421A98,NUL,?,00000000,?,00000000,00405BD5,?,?), ref: 00405A51
                                                          • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,00405BD5,?,?), ref: 00405A75
                                                          • GetShortPathNameA.KERNEL32 ref: 00405A7E
                                                            • Part of subcall function 004058D1: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004058E1
                                                            • Part of subcall function 004058D1: lstrlenA.KERNEL32(00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405913
                                                          • GetShortPathNameA.KERNEL32 ref: 00405A9B
                                                          • wsprintfA.USER32 ref: 00405AB9
                                                          • GetFileSize.KERNEL32(00000000,00000000,00421E98,C0000000,00000004,00421E98,?,?,?,?,?), ref: 00405AF4
                                                          • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405B03
                                                          • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B3B
                                                          • SetFilePointer.KERNEL32(004093B0,00000000,00000000,00000000,00000000,00421698,00000000,-0000000A,004093B0,00000000,[Rename],00000000,00000000,00000000), ref: 00405B91
                                                          • GlobalFree.KERNEL32 ref: 00405BA2
                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405BA9
                                                            • Part of subcall function 0040596C: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,80000000,00000003), ref: 00405970
                                                            • Part of subcall function 0040596C: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405992
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
                                                          • String ID: %s=%s$NUL$[Rename]
                                                          • API String ID: 222337774-4148678300
                                                          • Opcode ID: d0b3027ef6b6729443384411225f78b74e353092e57950ba2d6c15bf0c4c4ff6
                                                          • Instruction ID: 42b7cc2c3f2f4ef7c3412fd2f3d3cbe4eee66c4c235e50fd6e5efd85f9217fc4
                                                          • Opcode Fuzzy Hash: d0b3027ef6b6729443384411225f78b74e353092e57950ba2d6c15bf0c4c4ff6
                                                          • Instruction Fuzzy Hash: 9931E271A04B19ABD2206B619C89F6B3A6CDF45755F14003AFE05F62D2DA7CBC008E6D
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 100021FA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 139memoryCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 87%
                                                          			E100021FA(void* __edx, intOrPtr _a4) {
				signed int _v4;
				void* _t36;
				signed int _t37;
				void* _t38;
				void* _t47;
				signed int* _t49;
				signed int* _t50;
				void* _t51;

				_v4 = 0 |  *((intOrPtr*)(_a4 + 0x814)) > 0x00000000;
				while(1) {
					_t9 = _a4 + 0x818; // 0x818
					_t50 = (_v4 << 5) + _t9;
					_t36 = _t50[6];
					if(_t36 == 0) {
						goto L9;
					}
					_t47 = 0x1a;
					if(_t36 == _t47) {
						goto L9;
					}
					if(_t36 != 0xffffffff) {
						if(_t36 <= 0 || _t36 > 0x19) {
							_t50[6] = _t47;
						} else {
							_t36 = E100012AD(_t36 - 1);
							L10:
						}
						goto L11;
					} else {
						_t36 = E1000123B();
						L11:
						_t51 = _t36;
						_t13 =  &(_t50[2]); // 0x820
						_t49 = _t13;
						if(_t50[1] != 0xffffffff) {
						}
						_t37 =  *_t50;
						_t50[7] = _t50[7] & 0x00000000;
						if(_t37 > 7) {
							L27:
							_t38 = GlobalFree(_t51);
							if(_v4 == 0) {
								return _t38;
							}
							if(_v4 !=  *((intOrPtr*)(_a4 + 0x814))) {
								_v4 = _v4 + 1;
							} else {
								_v4 = _v4 & 0x00000000;
							}
							continue;
						} else {
							switch( *((intOrPtr*)(_t37 * 4 +  &M10002380))) {
								case 0:
									 *_t49 =  *_t49 & 0x00000000;
									goto L27;
								case 1:
									__eax = E100012FE(__ebp);
									goto L20;
								case 2:
									 *__ebx = E100012FE(__ebp);
									 *((intOrPtr*)(__ebx + 4)) = __edx;
									goto L27;
								case 3:
									__eax = E10001224(__ebp);
									 *(__esi + 0x1c) = __eax;
									L20:
									 *__ebx = __eax;
									goto L27;
								case 4:
									 *0x1000405c =  *0x1000405c +  *0x1000405c;
									__edi = GlobalAlloc(0x40,  *0x1000405c +  *0x1000405c);
									 *0x1000405c = MultiByteToWideChar(0, 0, __ebp,  *0x1000405c, __edi,  *0x1000405c);
									if( *__esi != 5) {
										 *(__esi + 0x1c) = __edi;
										 *__ebx = __edi;
									} else {
										__eax = GlobalAlloc(0x40, 0x10);
										_push(__eax);
										 *(__esi + 0x1c) = __eax;
										_push(__edi);
										 *__ebx = __eax;
										__imp__CLSIDFromString();
										__eax = GlobalFree(__edi);
									}
									goto L27;
								case 5:
									if(lstrlenA(__ebp) > 0) {
										__eax = E100012FE(__ebp);
										 *__edi = __eax;
									}
									goto L27;
								case 6:
									__esi =  *(__esi + 0x18);
									__esi = __esi - 1;
									__esi = __esi *  *0x1000405c;
									__esi = __esi +  *0x10004064;
									__eax = __esi + 0xc;
									 *__edi = __esi + 0xc;
									asm("cdq");
									__eax = E10001429(__edx, __esi + 0xc, __edx, __esi);
									goto L27;
							}
						}
					}
					L9:
					_t36 = E10001224(0x10004034);
					goto L10;
				}
			}











                                                          0x1000220e
                                                          0x10002212
                                                          0x1000221d
                                                          0x1000221d
                                                          0x10002224
                                                          0x10002229
                                                          0x00000000
                                                          0x00000000
                                                          0x1000222d
                                                          0x10002230
                                                          0x00000000
                                                          0x00000000
                                                          0x10002235
                                                          0x10002240
                                                          0x10002250
                                                          0x10002247
                                                          0x10002249
                                                          0x1000225f
                                                          0x1000225f
                                                          0x00000000
                                                          0x10002237
                                                          0x10002237
                                                          0x10002260
                                                          0x10002264
                                                          0x10002266
                                                          0x10002266
                                                          0x10002269
                                                          0x10002269
                                                          0x10002271
                                                          0x10002273
                                                          0x1000227a
                                                          0x10002349
                                                          0x1000234a
                                                          0x10002355
                                                          0x1000237f
                                                          0x1000237f
                                                          0x10002365
                                                          0x10002371
                                                          0x10002367
                                                          0x10002367
                                                          0x10002367
                                                          0x00000000
                                                          0x10002280
                                                          0x10002280
                                                          0x00000000
                                                          0x10002287
                                                          0x00000000
                                                          0x00000000
                                                          0x10002290
                                                          0x00000000
                                                          0x00000000
                                                          0x1000229e
                                                          0x100022a0
                                                          0x00000000
                                                          0x00000000
                                                          0x100022a9
                                                          0x100022ae
                                                          0x100022b1
                                                          0x100022b2
                                                          0x00000000
                                                          0x00000000
                                                          0x100022be
                                                          0x100022c9
                                                          0x100022d8
                                                          0x100022e1
                                                          0x10002303
                                                          0x10002306
                                                          0x100022e3
                                                          0x100022e7
                                                          0x100022ed
                                                          0x100022ee
                                                          0x100022f1
                                                          0x100022f2
                                                          0x100022f4
                                                          0x100022fb
                                                          0x100022fb
                                                          0x00000000
                                                          0x00000000
                                                          0x10002313
                                                          0x10002316
                                                          0x10002322
                                                          0x10002324
                                                          0x00000000
                                                          0x00000000
                                                          0x10002327
                                                          0x1000232a
                                                          0x1000232b
                                                          0x10002332
                                                          0x10002339
                                                          0x1000233c
                                                          0x1000233e
                                                          0x10002341
                                                          0x00000000
                                                          0x00000000
                                                          0x10002280
                                                          0x1000227a
                                                          0x10002255
                                                          0x1000225a
                                                          0x00000000
                                                          0x1000225a

                                                          APIs
                                                          • GlobalFree.KERNEL32 ref: 1000234A
                                                            • Part of subcall function 10001224: lstrcpynA.KERNEL32(00000000,?,100012CF,-1000404B,100011AB,-000000A0), ref: 10001234
                                                          • GlobalAlloc.KERNEL32(00000040,?), ref: 100022C3
                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 100022D8
                                                          • GlobalAlloc.KERNEL32(00000040,00000010), ref: 100022E7
                                                          • CLSIDFromString.OLE32(00000000,00000000), ref: 100022F4
                                                          • GlobalFree.KERNEL32 ref: 100022FB
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.524434554.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.524374525.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          • Associated: 00000000.00000002.524488197.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          • Associated: 00000000.00000002.524503265.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
                                                          • String ID: @uxv
                                                          • API String ID: 3730416702-3068791405
                                                          • Opcode ID: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
                                                          • Instruction ID: bfa8c22ebd78897ea4dc14f883c746723b208fa17a75ef0c69fbb79ff87ab60c
                                                          • Opcode Fuzzy Hash: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
                                                          • Instruction Fuzzy Hash: B541ABB1108311EFF320DFA48884B5BB7F8FF443D1F218529F946D61A9DB34AA448B61
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 100023DA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 111COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 89%
                                                          			E100023DA(intOrPtr* _a4) {
				char _v80;
				intOrPtr _v84;
				short _v92;
				intOrPtr* _t22;
				void* _t24;
				intOrPtr _t25;
				signed int _t33;
				void* _t37;
				intOrPtr _t38;
				void* _t41;

				_t37 = E10001215();
				_t22 = _a4;
				_t38 =  *((intOrPtr*)(_t22 + 0x814));
				_v84 = _t38;
				_t41 = (_t38 + 0x41 << 5) + _t22;
				do {
					if( *((intOrPtr*)(_t41 - 4)) != 0xffffffff) {
					}
					_t33 =  *(_t41 - 8);
					if(_t33 <= 7) {
						switch( *((intOrPtr*)(_t33 * 4 +  &M100024FD))) {
							case 0:
								 *_t37 = 0;
								goto L15;
							case 1:
								_push( *__eax);
								goto L13;
							case 2:
								__eax = E10001429(__edx,  *__eax,  *((intOrPtr*)(__eax + 4)), __edi);
								goto L14;
							case 3:
								__eax = lstrcpynA(__edi,  *__eax,  *0x1000405c);
								goto L15;
							case 4:
								__ecx =  *0x1000405c;
								__edx = __ecx - 1;
								__eax = WideCharToMultiByte(__ebx, __ebx,  *__eax, __ecx, __edi, __edx, __ebx, __ebx);
								__eax =  *0x1000405c;
								 *((char*)(__eax + __edi - 1)) = __bl;
								goto L15;
							case 5:
								__ecx =  &_v80;
								_push(0x27);
								_push( &_v80);
								_push( *__eax);
								" {xv@uxv"();
								__eax =  &_v92;
								__eax = WideCharToMultiByte(__ebx, __ebx,  &_v92,  &_v92, __edi,  *0x1000405c, __ebx, __ebx);
								goto L15;
							case 6:
								_push( *__esi);
								L13:
								__eax = wsprintfA(__edi, 0x10004000);
								L14:
								__esp = __esp + 0xc;
								goto L15;
						}
					}
					L15:
					_t24 =  *(_t41 + 0x14);
					if(_t24 != 0 && ( *_a4 != 2 ||  *((intOrPtr*)(_t41 - 4)) > 0)) {
						GlobalFree(_t24);
					}
					_t25 =  *((intOrPtr*)(_t41 + 0xc));
					if(_t25 != 0) {
						if(_t25 != 0xffffffff) {
							if(_t25 > 0) {
								E100012D1(_t25 - 1, _t37);
								goto L24;
							}
						} else {
							E10001266(_t37);
							L24:
						}
					}
					_v84 = _v84 - 1;
					_t41 = _t41 - 0x20;
				} while (_v84 >= 0);
				return GlobalFree(_t37);
			}













                                                          0x100023e6
                                                          0x100023e8
                                                          0x100023f2
                                                          0x100023f8
                                                          0x10002402
                                                          0x10002406
                                                          0x1000240a
                                                          0x1000240a
                                                          0x10002412
                                                          0x10002418
                                                          0x1000241e
                                                          0x00000000
                                                          0x10002425
                                                          0x00000000
                                                          0x00000000
                                                          0x10002429
                                                          0x00000000
                                                          0x00000000
                                                          0x10002433
                                                          0x00000000
                                                          0x00000000
                                                          0x10002443
                                                          0x00000000
                                                          0x00000000
                                                          0x1000246f
                                                          0x10002477
                                                          0x10002481
                                                          0x10002483
                                                          0x10002488
                                                          0x00000000
                                                          0x00000000
                                                          0x1000244b
                                                          0x1000244f
                                                          0x10002451
                                                          0x10002452
                                                          0x10002454
                                                          0x10002464
                                                          0x1000246b
                                                          0x00000000
                                                          0x00000000
                                                          0x1000248e
                                                          0x10002490
                                                          0x10002496
                                                          0x1000249c
                                                          0x1000249c
                                                          0x00000000
                                                          0x00000000
                                                          0x1000241e
                                                          0x1000249f
                                                          0x1000249f
                                                          0x100024a4
                                                          0x100024b5
                                                          0x100024b5
                                                          0x100024bb
                                                          0x100024c0
                                                          0x100024c5
                                                          0x100024d1
                                                          0x100024d6
                                                          0x00000000
                                                          0x100024db
                                                          0x100024c7
                                                          0x100024c8
                                                          0x100024dc
                                                          0x100024dc
                                                          0x100024c5
                                                          0x100024dd
                                                          0x100024e1
                                                          0x100024e4
                                                          0x100024fc

                                                          APIs
                                                            • Part of subcall function 10001215: GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D
                                                          • GlobalFree.KERNEL32 ref: 100024B5
                                                          • GlobalFree.KERNEL32 ref: 100024EF
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.524434554.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.524374525.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          • Associated: 00000000.00000002.524488197.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          • Associated: 00000000.00000002.524503265.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Global$Free$Alloc
                                                          • String ID: {xv@uxv
                                                          • API String ID: 1780285237-1953920604
                                                          • Opcode ID: 60efd3df625640f4be7515cacb253fcaf1935380dc2dc721e62c6f1304e53a66
                                                          • Instruction ID: 4e6b36a645f71e2aed4a85f2c36ff1861f2741140ba068ae73f9b0a79c1593cf
                                                          • Opcode Fuzzy Hash: 60efd3df625640f4be7515cacb253fcaf1935380dc2dc721e62c6f1304e53a66
                                                          • Instruction Fuzzy Hash: EA319CB1504250EFF322CF64CCC4C6B7BBDEB852D4B124529FA4193168CB31AC94DB62
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00405F64 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00405F64(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E004057D8(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E00405796("*?|<>/\":", _t5))) == 0) {
							E00405927(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}








                                                          0x00405f66
                                                          0x00405f6e
                                                          0x00405f82
                                                          0x00405f82
                                                          0x00405f88
                                                          0x00405f95
                                                          0x00405f95
                                                          0x00405f96
                                                          0x00405f98
                                                          0x00405f9c
                                                          0x00405f9e
                                                          0x00405fa7
                                                          0x00405fa9
                                                          0x00405fc3
                                                          0x00405fcb
                                                          0x00405fcb
                                                          0x00405fd0
                                                          0x00405fd2
                                                          0x00405fd4
                                                          0x00405fd8
                                                          0x00405fd9
                                                          0x00405fdc
                                                          0x00405fe4
                                                          0x00405fe6
                                                          0x00405fea
                                                          0x00000000
                                                          0x00000000
                                                          0x00405ff0
                                                          0x00405ff5
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00405ff5
                                                          0x00405ffa

                                                          APIs
                                                          • CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe",74D0FA90,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FBC
                                                          • CharNextA.USER32(?,?,?,00000000), ref: 00405FC9
                                                          • CharNextA.USER32(?,"C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe",74D0FA90,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FCE
                                                          • CharPrevA.USER32(?,?,74D0FA90,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FDE
                                                          Strings
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 00405F65
                                                          • *?|<>/":, xrefs: 00405FAC
                                                          • "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe", xrefs: 00405FA0
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Char$Next$Prev
                                                          • String ID: "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                          • API String ID: 589700163-1337670456
                                                          • Opcode ID: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
                                                          • Instruction ID: a0964663e3c08fb0288e5f4f4a0160773f2bbbf5a4d40b443b4f636863f092b1
                                                          • Opcode Fuzzy Hash: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
                                                          • Instruction Fuzzy Hash: C611C451808F922EEB3216640C44BBB7F99CF5A760F18007BE9D4B22C2D67C5C429F6E
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00402B7F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40timeCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00402B7F(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x40a8b8; // 0xa306e
					_t11 =  *0x4168c4; // 0xa37a0
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfA( &_v68, "verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}






                                                          0x00402b8c
                                                          0x00402b9a
                                                          0x00402ba0
                                                          0x00402ba0
                                                          0x00402bae
                                                          0x00402bb0
                                                          0x00402bb6
                                                          0x00402bbd
                                                          0x00402bbf
                                                          0x00402bbf
                                                          0x00402bd5
                                                          0x00402be5
                                                          0x00402bf7
                                                          0x00402bf7
                                                          0x00402bff

                                                          APIs
                                                          • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B9A
                                                          • MulDiv.KERNEL32(000A306E,00000064,000A37A0), ref: 00402BC5
                                                          • wsprintfA.USER32 ref: 00402BD5
                                                          • SetWindowTextA.USER32(?,?), ref: 00402BE5
                                                          • SetDlgItemTextA.USER32 ref: 00402BF7
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Text$ItemTimerWindowwsprintf
                                                          • String ID: n0$verifying installer: %d%%
                                                          • API String ID: 1451636040-4004012854
                                                          • Opcode ID: 649971ee7512e9da800057b1e5ac373431693e3f4f1e876899c067cd5a0faa84
                                                          • Instruction ID: bd73235a5a2a729140de961e31d76a0e47d27260d0eaef7d75f80e35c4c54abd
                                                          • Opcode Fuzzy Hash: 649971ee7512e9da800057b1e5ac373431693e3f4f1e876899c067cd5a0faa84
                                                          • Instruction Fuzzy Hash: EF01F471540208BBEF109F60DD49EEE3B79EB04305F008039FA16B51D1D7B59955DF59
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00403F45 Relevance: 12.1, APIs: 8, Instructions: 61COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00403F45(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t35;
				long _t37;
				void* _t40;
				long* _t49;

				if(_a4 + 0xfffffecd > 5) {
					L15:
					return 0;
				}
				_t49 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t49 == 0) {
					goto L15;
				}
				_t35 =  *_t49;
				if((_t49[5] & 0x00000002) != 0) {
					_t35 = GetSysColor(_t35);
				}
				if((_t49[5] & 0x00000001) != 0) {
					SetTextColor(_a8, _t35);
				}
				SetBkMode(_a8, _t49[4]);
				_t37 = _t49[1];
				_v16.lbColor = _t37;
				if((_t49[5] & 0x00000008) != 0) {
					_t37 = GetSysColor(_t37);
					_v16.lbColor = _t37;
				}
				if((_t49[5] & 0x00000004) != 0) {
					SetBkColor(_a8, _t37);
				}
				if((_t49[5] & 0x00000010) != 0) {
					_v16.lbStyle = _t49[2];
					_t40 = _t49[3];
					if(_t40 != 0) {
						DeleteObject(_t40);
					}
					_t49[3] = CreateBrushIndirect( &_v16);
				}
				return _t49[3];
			}








                                                          0x00403f57
                                                          0x00403feb
                                                          0x00000000
                                                          0x00403feb
                                                          0x00403f68
                                                          0x00403f6c
                                                          0x00000000
                                                          0x00000000
                                                          0x00403f72
                                                          0x00403f7b
                                                          0x00403f7e
                                                          0x00403f7e
                                                          0x00403f84
                                                          0x00403f8a
                                                          0x00403f8a
                                                          0x00403f96
                                                          0x00403f9c
                                                          0x00403fa3
                                                          0x00403fa6
                                                          0x00403fa9
                                                          0x00403fab
                                                          0x00403fab
                                                          0x00403fb3
                                                          0x00403fb9
                                                          0x00403fb9
                                                          0x00403fc3
                                                          0x00403fc8
                                                          0x00403fcb
                                                          0x00403fd0
                                                          0x00403fd3
                                                          0x00403fd3
                                                          0x00403fe3
                                                          0x00403fe3
                                                          0x00000000

                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                          • String ID:
                                                          • API String ID: 2320649405-0
                                                          • Opcode ID: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
                                                          • Instruction ID: 563dd17f99c902cd34f005863f03740a6a5938172a6e5e033378c94734032825
                                                          • Opcode Fuzzy Hash: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
                                                          • Instruction Fuzzy Hash: B4214271908705ABC7219F68DD48F4BBFF8AF01715B048A29E895E26E0D735EA04CB55
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 004047DD Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E004047DD(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}














                                                          0x004047eb
                                                          0x004047f8
                                                          0x004047fe
                                                          0x0040483c
                                                          0x0040483c
                                                          0x0040484b
                                                          0x00404852
                                                          0x00000000
                                                          0x00404854
                                                          0x00404800
                                                          0x0040480f
                                                          0x00404817
                                                          0x0040481a
                                                          0x0040482c
                                                          0x00404832
                                                          0x00404839
                                                          0x00000000
                                                          0x00404839
                                                          0x00000000

                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Message$Send$ClientScreen
                                                          • String ID: f
                                                          • API String ID: 41195575-1993550816
                                                          • Opcode ID: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
                                                          • Instruction ID: 206dc1e0429e6aa6b627cd25208fa2295557d59b2a7717453fa0c9894da25502
                                                          • Opcode Fuzzy Hash: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
                                                          • Instruction Fuzzy Hash: E6015276D00259BADB01DB94DC45FFEBBBCAF55711F10412BBA10B61C0C7B4A501CBA5
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00401D38 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 71%
                                                          			E00401D38() {
				void* __esi;
				int _t7;
				signed char _t13;
				struct HFONT__* _t16;
				void* _t20;
				struct HDC__* _t26;
				void* _t28;
				void* _t30;

				_t26 = GetDC( *(_t30 - 8));
				_t7 = GetDeviceCaps(_t26, 0x5a);
				0x40a7f0->lfHeight =  ~(MulDiv(E00402A1D(2), _t7, 0x48));
				ReleaseDC( *(_t30 - 8), _t26);
				 *0x40a800 = E00402A1D(3);
				_t13 =  *((intOrPtr*)(_t30 - 0x18));
				 *0x40a807 = 1;
				 *0x40a804 = _t13 & 0x00000001;
				 *0x40a805 = _t13 & 0x00000002;
				 *0x40a806 = _t13 & 0x00000004;
				E00405D1B(_t20, _t26, _t28, "Calibri",  *((intOrPtr*)(_t30 - 0x24)));
				_t16 = CreateFontIndirectA(0x40a7f0);
				_push(_t16);
				_push(_t28);
				E00405C57();
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}











                                                          0x00401d41
                                                          0x00401d48
                                                          0x00401d63
                                                          0x00401d68
                                                          0x00401d75
                                                          0x00401d7a
                                                          0x00401d85
                                                          0x00401d8c
                                                          0x00401d9e
                                                          0x00401da4
                                                          0x00401da9
                                                          0x00401db3
                                                          0x00402513
                                                          0x00401561
                                                          0x00402877
                                                          0x004028d2
                                                          0x004028de

                                                          APIs
                                                          • GetDC.USER32(?), ref: 00401D3B
                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D48
                                                          • MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D57
                                                          • ReleaseDC.USER32 ref: 00401D68
                                                          • CreateFontIndirectA.GDI32(0040A7F0), ref: 00401DB3
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: CapsCreateDeviceFontIndirectRelease
                                                          • String ID: Calibri
                                                          • API String ID: 3808545654-1409258342
                                                          • Opcode ID: 7cd5ed8a4b4f09cdd512241ed4d77026764b80ee4c75be1284d7c37bf19adfef
                                                          • Instruction ID: 818c9bdddfe1b1fffd76dbb1b88acba4993fd419864b94457e62d7fc32e1ff32
                                                          • Opcode Fuzzy Hash: 7cd5ed8a4b4f09cdd512241ed4d77026764b80ee4c75be1284d7c37bf19adfef
                                                          • Instruction Fuzzy Hash: FE016232948740AFE7416B70AE1AFAA3FB4A755305F108479F201B72E3C67811569B3F
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 004026C6 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 37%
                                                          			E004026C6(void* __ebx) {
				void* _t26;
				long _t31;
				void* _t45;
				void* _t49;
				void* _t51;
				void* _t54;
				void* _t55;
				void* _t56;

				_t45 = __ebx;
				 *((intOrPtr*)(_t56 - 0xc)) = 0xfffffd66;
				_t50 = E00402A3A(0xfffffff0);
				 *(_t56 - 0x38) = _t23;
				if(E004057D8(_t50) == 0) {
					E00402A3A(0xffffffed);
				}
				E00405947(_t50);
				_t26 = E0040596C(_t50, 0x40000000, 2);
				 *(_t56 + 8) = _t26;
				if(_t26 != 0xffffffff) {
					_t31 =  *0x423714;
					 *(_t56 - 0x30) = _t31;
					_t49 = GlobalAlloc(0x40, _t31);
					if(_t49 != _t45) {
						E00403091(_t45);
						E0040307B(_t49,  *(_t56 - 0x30));
						_t54 = GlobalAlloc(0x40,  *(_t56 - 0x20));
						 *(_t56 - 0x34) = _t54;
						if(_t54 != _t45) {
							_push( *(_t56 - 0x20));
							_push(_t54);
							_push(_t45);
							_push( *((intOrPtr*)(_t56 - 0x24)));
							E00402E9F();
							while( *_t54 != _t45) {
								_t47 =  *_t54;
								_t55 = _t54 + 8;
								 *(_t56 - 0x50) =  *_t54;
								E00405927( *((intOrPtr*)(_t54 + 4)) + _t49, _t55, _t47);
								_t54 = _t55 +  *(_t56 - 0x50);
							}
							GlobalFree( *(_t56 - 0x34));
						}
						E00405A13( *(_t56 + 8), _t49,  *(_t56 - 0x30));
						GlobalFree(_t49);
						_push(_t45);
						_push(_t45);
						_push( *(_t56 + 8));
						_push(0xffffffff);
						 *((intOrPtr*)(_t56 - 0xc)) = E00402E9F();
					}
					CloseHandle( *(_t56 + 8));
				}
				_t51 = 0xfffffff3;
				if( *((intOrPtr*)(_t56 - 0xc)) < _t45) {
					_t51 = 0xffffffef;
					DeleteFileA( *(_t56 - 0x38));
					 *((intOrPtr*)(_t56 - 4)) = 1;
				}
				_push(_t51);
				E00401423();
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t56 - 4));
				return 0;
			}











                                                          0x004026c6
                                                          0x004026c8
                                                          0x004026d4
                                                          0x004026d7
                                                          0x004026e1
                                                          0x004026e5
                                                          0x004026e5
                                                          0x004026eb
                                                          0x004026f8
                                                          0x00402700
                                                          0x00402703
                                                          0x00402709
                                                          0x00402717
                                                          0x0040271c
                                                          0x00402720
                                                          0x00402723
                                                          0x0040272c
                                                          0x00402738
                                                          0x0040273c
                                                          0x0040273f
                                                          0x00402741
                                                          0x00402744
                                                          0x00402745
                                                          0x00402746
                                                          0x00402749
                                                          0x00402768
                                                          0x00402750
                                                          0x00402755
                                                          0x0040275d
                                                          0x00402760
                                                          0x00402765
                                                          0x00402765
                                                          0x0040276f
                                                          0x0040276f
                                                          0x0040277c
                                                          0x00402782
                                                          0x00402788
                                                          0x00402789
                                                          0x0040278a
                                                          0x0040278d
                                                          0x00402794
                                                          0x00402794
                                                          0x0040279a
                                                          0x0040279a
                                                          0x004027a5
                                                          0x004027a6
                                                          0x004027aa
                                                          0x004027ae
                                                          0x004027b4
                                                          0x004027b4
                                                          0x004027bb
                                                          0x004021c4
                                                          0x004028d2
                                                          0x004028de

                                                          APIs
                                                          • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040271A
                                                          • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 00402736
                                                          • GlobalFree.KERNEL32 ref: 0040276F
                                                          • GlobalFree.KERNEL32 ref: 00402782
                                                          • CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040279A
                                                          • DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004027AE
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                          • String ID:
                                                          • API String ID: 2667972263-0
                                                          • Opcode ID: 0f1953924fa823fa64f56edeb7276902427a35836a51b24fa44fe1db59ad754c
                                                          • Instruction ID: 55e8cf3ffad71cabca96213aa966ad8f6b0c6824c0bc9dabfeb9c0d6c9f08848
                                                          • Opcode Fuzzy Hash: 0f1953924fa823fa64f56edeb7276902427a35836a51b24fa44fe1db59ad754c
                                                          • Instruction Fuzzy Hash: 03217C71800124BBCF216FA5DE89EAE7A79EF09324F14023AF950762D1C7795D418FA9
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 004046D3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 77%
                                                          			E004046D3(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				signed int _t22;
				void* _t29;
				void* _t31;
				void* _t32;
				void* _t41;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				signed int _t51;
				signed int _t53;

				_t21 = _a16;
				_t51 = _a12;
				_t41 = 0xffffffdc;
				if(_t21 == 0) {
					_push(0x14);
					_pop(0);
					_t22 = _t51;
					if(_t51 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t41 = 0xffffffdd;
					}
					if(_t51 < 0x400) {
						_t41 = 0xffffffde;
					}
					if(_t51 < 0xffff3333) {
						_t50 = 0x14;
						asm("cdq");
						_t22 = 1 / _t50 + _t51;
					}
					_t23 = _t22 & 0x00ffffff;
					_t53 = _t22 >> 0;
					_t43 = 0xa;
					_t47 = ((_t22 & 0x00ffffff) + _t23 * 4 + (_t22 & 0x00ffffff) + _t23 * 4 >> 0) % _t43;
				} else {
					_t53 = (_t21 << 0x00000020 | _t51) >> 0x14;
					_t47 = 0;
				}
				_t29 = E00405D1B(_t41, _t47, _t53,  &_v36, 0xffffffdf);
				_t31 = E00405D1B(_t41, _t47, _t53,  &_v68, _t41);
				_t32 = E00405D1B(_t41, _t47, 0x41fd08, 0x41fd08, _a8);
				wsprintfA(_t32 + lstrlenA(0x41fd08), "%u.%u%s%s", _t53, _t47, _t31, _t29);
				return SetDlgItemTextA( *0x422ed8, _a4, 0x41fd08);
			}



















                                                          0x004046d9
                                                          0x004046de
                                                          0x004046e6
                                                          0x004046e7
                                                          0x004046f4
                                                          0x004046fc
                                                          0x004046fd
                                                          0x004046ff
                                                          0x00404701
                                                          0x00404703
                                                          0x00404706
                                                          0x00404706
                                                          0x0040470d
                                                          0x00404713
                                                          0x00404713
                                                          0x0040471a
                                                          0x00404721
                                                          0x00404724
                                                          0x00404727
                                                          0x00404727
                                                          0x0040472b
                                                          0x0040473b
                                                          0x0040473d
                                                          0x00404740
                                                          0x004046e9
                                                          0x004046e9
                                                          0x004046f0
                                                          0x004046f0
                                                          0x00404748
                                                          0x00404753
                                                          0x00404769
                                                          0x00404779
                                                          0x00404795

                                                          APIs
                                                          • lstrlenA.KERNEL32(Staalbrylluppets Setup: Installing,Staalbrylluppets Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004045EE,000000DF,00000000,00000400,?), ref: 00404771
                                                          • wsprintfA.USER32 ref: 00404779
                                                          • SetDlgItemTextA.USER32 ref: 0040478C
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: ItemTextlstrlenwsprintf
                                                          • String ID: %u.%u%s%s$Staalbrylluppets Setup: Installing
                                                          • API String ID: 3540041739-4113607515
                                                          • Opcode ID: 7544711cfd2888e06e1ba87e6b8ba603e98340ee2fedd065ee79b71864dce579
                                                          • Instruction ID: 079308417c3a62341de1df324b483ce4e469374b9790fc4fe8de96a48b85a08e
                                                          • Opcode Fuzzy Hash: 7544711cfd2888e06e1ba87e6b8ba603e98340ee2fedd065ee79b71864dce579
                                                          • Instruction Fuzzy Hash: F011A573A0412837EB0065699C45EAF3298DB86374F254637FA25F71D2EA788C5245A8
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 1000180D Relevance: 7.7, APIs: 5, Instructions: 189COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 97%
                                                          			E1000180D(signed int __edx, void* __eflags, void* _a8, void* _a16) {
				void* _v8;
				signed int _v12;
				signed int _v20;
				signed int _v24;
				char _v52;
				void* _t43;
				signed int _t44;
				signed int _t59;
				void _t63;
				void _t64;
				signed int _t65;
				signed int _t67;
				signed int _t68;
				signed int _t70;
				signed int _t71;
				void* _t76;
				void* _t77;
				void* _t78;
				void* _t79;
				void* _t80;
				signed int _t84;
				signed int _t86;
				signed int _t89;
				void* _t100;

				_t84 = __edx;
				 *0x1000405c = _a8;
				_t59 = 0;
				 *0x10004060 = _a16;
				_v12 = 0;
				_v8 = E1000123B();
				_t89 = E100012FE(_t41);
				_t86 = _t84;
				_t43 = E1000123B();
				_t63 =  *_t43;
				_a8 = _t43;
				if(_t63 != 0x7e && _t63 != 0x21) {
					_a16 = E1000123B();
					_t59 = E100012FE(_t56);
					_v12 = _t84;
					GlobalFree(_a16);
					_t43 = _a8;
				}
				_t64 =  *_t43;
				_t100 = _t64 - 0x2f;
				if(_t100 > 0) {
					_t65 = _t64 - 0x3c;
					__eflags = _t65;
					if(_t65 == 0) {
						__eflags =  *((char*)(_t43 + 1)) - 0x3c;
						if( *((char*)(_t43 + 1)) != 0x3c) {
							__eflags = _t86 - _v12;
							if(__eflags > 0) {
								L54:
								_t44 = 0;
								__eflags = 0;
								L55:
								asm("cdq");
								L56:
								_t89 = _t44;
								L57:
								_t86 = _t84;
								L58:
								E10001429(_t84, _t89, _t86,  &_v52);
								E10001266( &_v52);
								GlobalFree(_v8);
								return GlobalFree(_a8);
							}
							if(__eflags < 0) {
								L47:
								__eflags = 0;
								L48:
								_t44 = 1;
								goto L55;
							}
							__eflags = _t89 - _t59;
							if(_t89 < _t59) {
								goto L47;
							}
							goto L54;
						}
						_t84 = _t86;
						_t44 = E10002CD0(_t89, _t59, _t84);
						goto L56;
					}
					_t67 = _t65 - 1;
					__eflags = _t67;
					if(_t67 == 0) {
						__eflags = _t89 - _t59;
						if(_t89 != _t59) {
							goto L54;
						}
						__eflags = _t86 - _v12;
						if(_t86 != _v12) {
							goto L54;
						}
						goto L47;
					}
					_t68 = _t67 - 1;
					__eflags = _t68;
					if(_t68 == 0) {
						__eflags =  *((char*)(_t43 + 1)) - 0x3e;
						if( *((char*)(_t43 + 1)) != 0x3e) {
							__eflags = _t86 - _v12;
							if(__eflags < 0) {
								goto L54;
							}
							if(__eflags > 0) {
								goto L47;
							}
							__eflags = _t89 - _t59;
							if(_t89 <= _t59) {
								goto L54;
							}
							goto L47;
						}
						_t84 = _t86;
						_t44 = E10002CF0(_t89, _t59, _t84);
						goto L56;
					}
					_t70 = _t68 - 0x20;
					__eflags = _t70;
					if(_t70 == 0) {
						_t89 = _t89 ^ _t59;
						_t86 = _t86 ^ _v12;
						goto L58;
					}
					_t71 = _t70 - 0x1e;
					__eflags = _t71;
					if(_t71 == 0) {
						__eflags =  *((char*)(_t43 + 1)) - 0x7c;
						if( *((char*)(_t43 + 1)) != 0x7c) {
							_t89 = _t89 | _t59;
							_t86 = _t86 | _v12;
							goto L58;
						}
						__eflags = _t89 | _t86;
						if((_t89 | _t86) != 0) {
							goto L47;
						}
						__eflags = _t59 | _v12;
						if((_t59 | _v12) != 0) {
							goto L47;
						}
						goto L54;
					}
					__eflags = _t71 == 0;
					if(_t71 == 0) {
						_t89 =  !_t89;
						_t86 =  !_t86;
					}
					goto L58;
				}
				if(_t100 == 0) {
					L21:
					__eflags = _t59 | _v12;
					if((_t59 | _v12) != 0) {
						_v24 = E10002B60(_t89, _t86, _t59, _v12);
						_v20 = _t84;
						_t89 = E10002C10(_t89, _t86, _t59, _v12);
						_t43 = _a8;
					} else {
						_v24 = _v24 & 0x00000000;
						_v20 = _v20 & 0x00000000;
						_t84 = _t86;
					}
					__eflags =  *_t43 - 0x2f;
					if( *_t43 != 0x2f) {
						goto L57;
					} else {
						_t89 = _v24;
						_t86 = _v20;
						goto L58;
					}
				}
				_t76 = _t64 - 0x21;
				if(_t76 == 0) {
					_t44 = 0;
					__eflags = _t89 | _t86;
					if((_t89 | _t86) != 0) {
						goto L55;
					}
					goto L48;
				}
				_t77 = _t76 - 4;
				if(_t77 == 0) {
					goto L21;
				}
				_t78 = _t77 - 1;
				if(_t78 == 0) {
					__eflags =  *((char*)(_t43 + 1)) - 0x26;
					if( *((char*)(_t43 + 1)) != 0x26) {
						_t89 = _t89 & _t59;
						_t86 = _t86 & _v12;
						goto L58;
					}
					__eflags = _t89 | _t86;
					if((_t89 | _t86) == 0) {
						goto L54;
					}
					__eflags = _t59 | _v12;
					if((_t59 | _v12) == 0) {
						goto L54;
					}
					goto L47;
				}
				_t79 = _t78 - 4;
				if(_t79 == 0) {
					_t44 = E10002B20(_t89, _t86, _t59, _v12);
					goto L56;
				} else {
					_t80 = _t79 - 1;
					if(_t80 == 0) {
						_t89 = _t89 + _t59;
						asm("adc edi, [ebp-0x8]");
					} else {
						if(_t80 == 0) {
							_t89 = _t89 - _t59;
							asm("sbb edi, [ebp-0x8]");
						}
					}
					goto L58;
				}
			}



























                                                          0x1000180d
                                                          0x10001817
                                                          0x10001820
                                                          0x10001823
                                                          0x10001828
                                                          0x10001831
                                                          0x1000183a
                                                          0x1000183c
                                                          0x1000183e
                                                          0x10001843
                                                          0x10001845
                                                          0x1000184b
                                                          0x10001858
                                                          0x10001861
                                                          0x10001866
                                                          0x10001869
                                                          0x1000186f
                                                          0x1000186f
                                                          0x10001872
                                                          0x10001875
                                                          0x10001878
                                                          0x1000193e
                                                          0x1000193e
                                                          0x10001941
                                                          0x100019aa
                                                          0x100019ae
                                                          0x100019bd
                                                          0x100019c0
                                                          0x100019c8
                                                          0x100019c8
                                                          0x100019c8
                                                          0x100019ca
                                                          0x100019ca
                                                          0x100019cb
                                                          0x100019cb
                                                          0x100019cd
                                                          0x100019cd
                                                          0x100019cf
                                                          0x100019d5
                                                          0x100019de
                                                          0x100019ef
                                                          0x100019fa
                                                          0x100019fa
                                                          0x100019c2
                                                          0x100019a5
                                                          0x100019a5
                                                          0x100019a7
                                                          0x100019a7
                                                          0x00000000
                                                          0x100019a7
                                                          0x100019c4
                                                          0x100019c6
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x100019c6
                                                          0x100019b2
                                                          0x100019b6
                                                          0x00000000
                                                          0x100019b6
                                                          0x10001943
                                                          0x10001943
                                                          0x10001944
                                                          0x1000199c
                                                          0x1000199e
                                                          0x00000000
                                                          0x00000000
                                                          0x100019a0
                                                          0x100019a3
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x100019a3
                                                          0x10001946
                                                          0x10001946
                                                          0x10001947
                                                          0x1000197c
                                                          0x10001980
                                                          0x1000198f
                                                          0x10001992
                                                          0x00000000
                                                          0x00000000
                                                          0x10001994
                                                          0x00000000
                                                          0x00000000
                                                          0x10001996
                                                          0x10001998
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x1000199a
                                                          0x10001984
                                                          0x10001988
                                                          0x00000000
                                                          0x10001988
                                                          0x10001949
                                                          0x10001949
                                                          0x1000194c
                                                          0x10001975
                                                          0x10001977
                                                          0x00000000
                                                          0x10001977
                                                          0x1000194e
                                                          0x1000194e
                                                          0x10001951
                                                          0x1000195d
                                                          0x10001961
                                                          0x1000196e
                                                          0x10001970
                                                          0x00000000
                                                          0x10001970
                                                          0x10001963
                                                          0x10001965
                                                          0x00000000
                                                          0x00000000
                                                          0x10001967
                                                          0x1000196a
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x1000196c
                                                          0x10001954
                                                          0x10001955
                                                          0x10001957
                                                          0x10001959
                                                          0x10001959
                                                          0x00000000
                                                          0x10001955
                                                          0x1000187e
                                                          0x100018f6
                                                          0x100018f8
                                                          0x100018fb
                                                          0x10001917
                                                          0x1000191a
                                                          0x10001925
                                                          0x10001927
                                                          0x100018fd
                                                          0x100018fd
                                                          0x10001901
                                                          0x10001905
                                                          0x10001905
                                                          0x1000192a
                                                          0x1000192d
                                                          0x00000000
                                                          0x10001933
                                                          0x10001933
                                                          0x10001936
                                                          0x00000000
                                                          0x10001936
                                                          0x1000192d
                                                          0x10001880
                                                          0x10001883
                                                          0x100018e7
                                                          0x100018e9
                                                          0x100018eb
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x100018f1
                                                          0x10001885
                                                          0x10001888
                                                          0x00000000
                                                          0x00000000
                                                          0x1000188a
                                                          0x1000188b
                                                          0x100018c1
                                                          0x100018c5
                                                          0x100018dd
                                                          0x100018df
                                                          0x00000000
                                                          0x100018df
                                                          0x100018c7
                                                          0x100018c9
                                                          0x00000000
                                                          0x00000000
                                                          0x100018cf
                                                          0x100018d2
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x100018d8
                                                          0x1000188d
                                                          0x10001890
                                                          0x100018b7
                                                          0x00000000
                                                          0x10001892
                                                          0x10001892
                                                          0x10001893
                                                          0x100018a7
                                                          0x100018a9
                                                          0x10001895
                                                          0x10001897
                                                          0x1000189d
                                                          0x1000189f
                                                          0x1000189f
                                                          0x10001897
                                                          0x00000000
                                                          0x10001893

                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.524434554.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.524374525.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          • Associated: 00000000.00000002.524488197.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          • Associated: 00000000.00000002.524503265.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: FreeGlobal
                                                          • String ID:
                                                          • API String ID: 2979337801-0
                                                          • Opcode ID: 77a81084fec204f063f391a72417a48794b03369041568a62b2ea2bb83db45b2
                                                          • Instruction ID: adaf369aa6dab84e94bee76403d526b7d43184adb12fe210256c1aedb67fe499
                                                          • Opcode Fuzzy Hash: 77a81084fec204f063f391a72417a48794b03369041568a62b2ea2bb83db45b2
                                                          • Instruction Fuzzy Hash: 43512536D04159AEFB55DFB488A4AEEBBF6EF453C0F124169E841B315DCA306E4087D2
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00401CDE Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00401CDE(int __edx) {
				void* _t17;
				struct HINSTANCE__* _t21;
				struct HWND__* _t25;
				void* _t27;

				_t25 = GetDlgItem( *(_t27 - 8), __edx);
				GetClientRect(_t25, _t27 - 0x58);
				_t17 = SendMessageA(_t25, 0x172, _t21, LoadImageA(_t21, E00402A3A(_t21), _t21,  *(_t27 - 0x50) *  *(_t27 - 0x20),  *(_t27 - 0x4c) *  *(_t27 - 0x20), 0x10));
				if(_t17 != _t21) {
					DeleteObject(_t17);
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t27 - 4));
				return 0;
			}







                                                          0x00401ce8
                                                          0x00401cef
                                                          0x00401d1e
                                                          0x00401d26
                                                          0x00401d2d
                                                          0x00401d2d
                                                          0x004028d2
                                                          0x004028de

                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                          • String ID:
                                                          • API String ID: 1849352358-0
                                                          • Opcode ID: 17232caade98c5884c3b98c25dda3274542a73d841a3bd6b31c87e9b59191b88
                                                          • Instruction ID: 14b9f5ff68e8b0ed0f2204d74c17d06140583eb6ed2bbf798243b331d3a4cd3b
                                                          • Opcode Fuzzy Hash: 17232caade98c5884c3b98c25dda3274542a73d841a3bd6b31c87e9b59191b88
                                                          • Instruction Fuzzy Hash: A9F0E7B2A04114AFEB01ABE4DE88DAFB7BDEB54305B10447AF602F6191C7789D018B79
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040393E Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E0040393E(void* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t6;
				intOrPtr _t11;
				signed int _t13;
				signed int _t16;
				signed short* _t18;
				signed int _t20;
				signed short* _t23;
				intOrPtr _t25;
				signed int _t26;
				intOrPtr* _t27;

				_t24 = "1033";
				_t13 = 0xffff;
				_t6 = E00405C70(__ecx, "1033");
				while(1) {
					_t26 =  *0x423744;
					if(_t26 == 0) {
						goto L7;
					}
					_t16 =  *( *0x423710 + 0x64);
					_t20 =  ~_t16;
					_t18 = _t16 * _t26 +  *0x423740;
					while(1) {
						_t18 = _t18 + _t20;
						_t26 = _t26 - 1;
						if((( *_t18 ^ _t6) & _t13) == 0) {
							break;
						}
						if(_t26 != 0) {
							continue;
						}
						goto L7;
					}
					 *0x422ee0 = _t18[1];
					 *0x4237a8 = _t18[3];
					_t23 =  &(_t18[5]);
					if(_t23 != 0) {
						 *0x422edc = _t23;
						E00405C57(_t24,  *_t18 & 0x0000ffff);
						SetWindowTextA( *0x41fce8, E00405D1B(_t13, _t24, _t26, 0x422f00, 0xfffffffe));
						_t11 =  *0x42372c;
						_t27 =  *0x423728;
						if(_t11 == 0) {
							L15:
							return _t11;
						}
						_t25 = _t11;
						do {
							_t11 =  *_t27;
							if(_t11 != 0) {
								_t11 = E00405D1B(_t13, _t25, _t27, _t27 + 0x18, _t11);
							}
							_t27 = _t27 + 0x418;
							_t25 = _t25 - 1;
						} while (_t25 != 0);
						goto L15;
					}
					L7:
					if(_t13 != 0xffff) {
						_t13 = 0;
					} else {
						_t13 = 0x3ff;
					}
				}
			}
















                                                          0x00403942
                                                          0x00403947
                                                          0x0040394d
                                                          0x00403952
                                                          0x00403952
                                                          0x0040395a
                                                          0x00000000
                                                          0x00000000
                                                          0x00403962
                                                          0x0040396a
                                                          0x0040396c
                                                          0x00403972
                                                          0x00403972
                                                          0x00403974
                                                          0x00403980
                                                          0x00000000
                                                          0x00000000
                                                          0x00403984
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00403986
                                                          0x0040398b
                                                          0x00403994
                                                          0x0040399a
                                                          0x0040399f
                                                          0x004039b3
                                                          0x004039be
                                                          0x004039d6
                                                          0x004039dc
                                                          0x004039e1
                                                          0x004039e9
                                                          0x00403a0a
                                                          0x00403a0a
                                                          0x00403a0a
                                                          0x004039eb
                                                          0x004039ed
                                                          0x004039ed
                                                          0x004039f1
                                                          0x004039f8
                                                          0x004039f8
                                                          0x004039fd
                                                          0x00403a03
                                                          0x00403a03
                                                          0x00000000
                                                          0x004039ed
                                                          0x004039a1
                                                          0x004039a6
                                                          0x004039af
                                                          0x004039a8
                                                          0x004039a8
                                                          0x004039a8
                                                          0x004039a6

                                                          APIs
                                                          • SetWindowTextA.USER32(00000000,00422F00), ref: 004039D6
                                                          Strings
                                                          • 1033, xrefs: 00403942, 0040394C, 004039BD
                                                          • "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe", xrefs: 0040393F
                                                          • Staalbrylluppets Setup: Installing, xrefs: 00403941
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: TextWindow
                                                          • String ID: "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe"$1033$Staalbrylluppets Setup: Installing
                                                          • API String ID: 530164218-3278578313
                                                          • Opcode ID: 244e9df2a614901431107d3dfbb7f61988cd02e76e3af48c4d8827d28496723d
                                                          • Instruction ID: 79edc1b1becbb318b5d11430581b7fe373163fbdb48c995140def98ab9010f1e
                                                          • Opcode Fuzzy Hash: 244e9df2a614901431107d3dfbb7f61988cd02e76e3af48c4d8827d28496723d
                                                          • Instruction Fuzzy Hash: B311F3F1B04611ABCB20DF14DD809737BADEBC4756328823FE941A73A0C67D9D029B98
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00405859 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46stringCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 53%
                                                          			E00405859(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr* _t21;
				void* _t22;

				E00405CF9(0x421110, _a4);
				_t21 = E00405804(0x421110);
				if(_t21 != 0) {
					E00405F64(_t21);
					if(( *0x423718 & 0x00000080) == 0) {
						L5:
						_t22 = _t21 - 0x421110;
						while(1) {
							_t11 = lstrlenA(0x421110);
							_push(0x421110);
							if(_t11 <= _t22) {
								break;
							}
							_t12 = E00405FFD();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E004057B2(0x421110);
								continue;
							} else {
								goto L1;
							}
						}
						E0040576B();
						return 0 | GetFileAttributesA(??) != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}








                                                          0x00405865
                                                          0x00405870
                                                          0x00405874
                                                          0x0040587b
                                                          0x00405887
                                                          0x00405893
                                                          0x00405893
                                                          0x004058ab
                                                          0x004058ac
                                                          0x004058b3
                                                          0x004058b4
                                                          0x00000000
                                                          0x00000000
                                                          0x00405897
                                                          0x0040589e
                                                          0x004058a6
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040589e
                                                          0x004058b6
                                                          0x00000000
                                                          0x004058ca
                                                          0x00405889
                                                          0x0040588d
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040588d
                                                          0x00405876
                                                          0x00000000

                                                          APIs
                                                            • Part of subcall function 00405CF9: lstrcpynA.KERNEL32(?,?,00000400,00403187,00422F00,NSIS Error), ref: 00405D06
                                                            • Part of subcall function 00405804: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,?,00405870,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,74D0FA90,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,74D0FA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405812
                                                            • Part of subcall function 00405804: CharNextA.USER32(00000000), ref: 00405817
                                                            • Part of subcall function 00405804: CharNextA.USER32(00000000), ref: 0040582B
                                                          • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,74D0FA90,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,74D0FA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058AC
                                                          • GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,74D0FA90,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,74D0FA90,C:\Users\user\AppData\Local\Temp\), ref: 004058BC
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                          • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp
                                                          • API String ID: 3248276644-3744439891
                                                          • Opcode ID: 2f5f7bd10b83e5c994280ddce28bb3e0edcf250d71028fabecdb2709bf5dd46b
                                                          • Instruction ID: 1d2993da53655c0900dfa7f8eb6ffa86a16769ab8224128061af08a25d69d353
                                                          • Opcode Fuzzy Hash: 2f5f7bd10b83e5c994280ddce28bb3e0edcf250d71028fabecdb2709bf5dd46b
                                                          • Instruction Fuzzy Hash: 16F0F427105E5165DA22323B1C05B9F1A44CD86354718C53BFC51F22D2DA3CC8629DBE
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040576B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E0040576B(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x409014);
				}
				return _t7;
			}




                                                          0x0040576c
                                                          0x00405783
                                                          0x0040578b
                                                          0x0040578b
                                                          0x00405793

                                                          APIs
                                                          • lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030C6,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405771
                                                          • CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030C6,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 0040577A
                                                          • lstrcatA.KERNEL32(?,00409014), ref: 0040578B
                                                          Strings
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 0040576B
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: CharPrevlstrcatlstrlen
                                                          • String ID: C:\Users\user\AppData\Local\Temp\
                                                          • API String ID: 2659869361-3916508600
                                                          • Opcode ID: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
                                                          • Instruction ID: 00e6a1abdfef3fccf4d12e3b382aa79108487555f8088e95eeaee7bf5793dfbe
                                                          • Opcode Fuzzy Hash: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
                                                          • Instruction Fuzzy Hash: 94D0A9B2A05A307AD3122715AC0DE8B2A08CF82300B094023F200B72A2CB3C1D418BFE
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00405804 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00405804(CHAR* _a4) {
				CHAR* _t5;
				char* _t7;
				CHAR* _t9;
				char _t10;
				CHAR* _t11;
				void* _t13;

				_t11 = _a4;
				_t9 = CharNextA(_t11);
				_t5 = CharNextA(_t9);
				_t10 =  *_t11;
				if(_t10 == 0 ||  *_t9 != 0x3a || _t9[1] != 0x5c) {
					if(_t10 != 0x5c || _t11[1] != _t10) {
						L10:
						return 0;
					} else {
						_t13 = 2;
						while(1) {
							_t13 = _t13 - 1;
							_t7 = E00405796(_t5, 0x5c);
							if( *_t7 == 0) {
								goto L10;
							}
							_t5 = _t7 + 1;
							if(_t13 != 0) {
								continue;
							}
							return _t5;
						}
						goto L10;
					}
				} else {
					return CharNextA(_t5);
				}
			}









                                                          0x0040580d
                                                          0x00405814
                                                          0x00405817
                                                          0x00405819
                                                          0x0040581d
                                                          0x00405832
                                                          0x00405851
                                                          0x00000000
                                                          0x00405839
                                                          0x0040583b
                                                          0x0040583c
                                                          0x0040583f
                                                          0x00405840
                                                          0x00405848
                                                          0x00000000
                                                          0x00000000
                                                          0x0040584a
                                                          0x0040584d
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040584d
                                                          0x00000000
                                                          0x0040583c
                                                          0x0040582a
                                                          0x00000000
                                                          0x0040582b

                                                          APIs
                                                          • CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,?,00405870,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp,74D0FA90,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,74D0FA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405812
                                                          • CharNextA.USER32(00000000), ref: 00405817
                                                          • CharNextA.USER32(00000000), ref: 0040582B
                                                          Strings
                                                          • C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp, xrefs: 00405805
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: CharNext
                                                          • String ID: C:\Users\user\AppData\Local\Temp\nsgFEE3.tmp
                                                          • API String ID: 3213498283-3143865396
                                                          • Opcode ID: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
                                                          • Instruction ID: 4ca260c7e1a22d06af12069221c3406c2bee361732d71c1e98a9e22686a99acb
                                                          • Opcode Fuzzy Hash: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
                                                          • Instruction Fuzzy Hash: 71F0C253908F942BFB3276641C44B675F88DB55350F04C07BEA80B62C2C6788860CBEA
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00402C02 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00402C02(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x4168c0; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x42370c;
						if(_t2 >  *0x42370c) {
							_t3 = CreateDialogParamA( *0x423700, 0x6f, 0, E00402B7F, 0);
							 *0x4168c0 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E004060CE(0);
					}
				} else {
					_t6 =  *0x4168c0; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x4168c0 = 0;
					return _t6;
				}
			}






                                                          0x00402c09
                                                          0x00402c23
                                                          0x00402c29
                                                          0x00402c33
                                                          0x00402c39
                                                          0x00402c3f
                                                          0x00402c50
                                                          0x00402c59
                                                          0x00000000
                                                          0x00402c5e
                                                          0x00402c65
                                                          0x00402c2b
                                                          0x00402c32
                                                          0x00402c32
                                                          0x00402c0b
                                                          0x00402c0b
                                                          0x00402c12
                                                          0x00402c15
                                                          0x00402c15
                                                          0x00402c1b
                                                          0x00402c22
                                                          0x00402c22

                                                          APIs
                                                          • DestroyWindow.USER32(00000000,00000000,00402DE2,00000001), ref: 00402C15
                                                          • GetTickCount.KERNEL32 ref: 00402C33
                                                          • CreateDialogParamA.USER32(0000006F,00000000,00402B7F,00000000), ref: 00402C50
                                                          • ShowWindow.USER32(00000000,00000005), ref: 00402C5E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Window$CountCreateDestroyDialogParamShowTick
                                                          • String ID:
                                                          • API String ID: 2102729457-0
                                                          • Opcode ID: bb4189f2555980a5a403f1716edff6096ea92162ad211e01232e213a33bdd725
                                                          • Instruction ID: 69bd14cd8f1a0d496662edafeb8c2727d8675a530a128bc1770b64b88ff4c26b
                                                          • Opcode Fuzzy Hash: bb4189f2555980a5a403f1716edff6096ea92162ad211e01232e213a33bdd725
                                                          • Instruction Fuzzy Hash: 2CF05E7090A220ABD6217F64FE0CDDF7BA4FB41B527018576F144B21E4C379988ACB9D
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00404E86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 91%
                                                          			E00404E86(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t11;
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					__eflags = _t15 - 0x200;
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						__eflags = _t15 - 0x419;
						if(_t15 == 0x419) {
							__eflags =  *0x41fcf4 - _t16; // 0x0
							if(__eflags != 0) {
								_push(_t16);
								_push(6);
								 *0x41fcf4 = _t16;
								E0040485D();
							}
						}
						L11:
						return CallWindowProcA( *0x41fcfc, _a4, _t15, _a12, _t16);
					}
					_t11 = IsWindowVisible(_a4);
					__eflags = _t11;
					if(_t11 == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E004047DD(_a4, 1);
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 == 0x20) {
					E00403F2A(0x413);
					return 0;
				}
				goto L10;
			}






                                                          0x00404e8a
                                                          0x00404e94
                                                          0x00404eaa
                                                          0x00404eb0
                                                          0x00404ed2
                                                          0x00404ed5
                                                          0x00404ed5
                                                          0x00404edb
                                                          0x00404edd
                                                          0x00404ee3
                                                          0x00404ee5
                                                          0x00404ee6
                                                          0x00404ee8
                                                          0x00404eee
                                                          0x00404eee
                                                          0x00404ee3
                                                          0x00404ef8
                                                          0x00000000
                                                          0x00404f06
                                                          0x00404eb5
                                                          0x00404ebb
                                                          0x00404ebd
                                                          0x00404ef5
                                                          0x00404ef5
                                                          0x00000000
                                                          0x00404ef5
                                                          0x00404ec9
                                                          0x00404ecb
                                                          0x00000000
                                                          0x00404ecb
                                                          0x00404e9a
                                                          0x00404ea1
                                                          0x00000000
                                                          0x00404ea6
                                                          0x00000000

                                                          APIs
                                                          • IsWindowVisible.USER32(?), ref: 00404EB5
                                                          • CallWindowProcA.USER32 ref: 00404F06
                                                            • Part of subcall function 00403F2A: SendMessageA.USER32 ref: 00403F3C
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Window$CallMessageProcSendVisible
                                                          • String ID:
                                                          • API String ID: 3748168415-3916222277
                                                          • Opcode ID: d7dba211b113031370aa0d375adf93c2d3682e4ecf800ebd227cab9ba7078c69
                                                          • Instruction ID: f49a9e3fcece2dd6490d1841f3d0f5b5163df4d3f93a23d44cf999a9bd086e10
                                                          • Opcode Fuzzy Hash: d7dba211b113031370aa0d375adf93c2d3682e4ecf800ebd227cab9ba7078c69
                                                          • Instruction Fuzzy Hash: D10171B110020EABDF209F11DC84A9B3725FBC4754F208037FB11761D1DB799C61A7A9
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 004035E4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E004035E4() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x41eccc; // 0x61b1a0
				_t3 = E004035C9(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8));
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x41eccc =  *0x41eccc & 0x00000000;
				return _t3;
			}







                                                          0x004035e5
                                                          0x004035ed
                                                          0x004035f4
                                                          0x004035f7
                                                          0x004035f7
                                                          0x004035f9
                                                          0x004035fe
                                                          0x00403605
                                                          0x0040360b
                                                          0x0040360f
                                                          0x00403610
                                                          0x00403618

                                                          APIs
                                                          • FreeLibrary.KERNEL32(?,74D0FA90,00000000,C:\Users\user\AppData\Local\Temp\,004035BC,004033D6,?), ref: 004035FE
                                                          • GlobalFree.KERNEL32 ref: 00403605
                                                          Strings
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 004035E4
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Free$GlobalLibrary
                                                          • String ID: C:\Users\user\AppData\Local\Temp\
                                                          • API String ID: 1100898210-3916508600
                                                          • Opcode ID: a52acb0b260d536fd7618f3e20de318eec4c6c539c6bb2def64801f0e67eaa78
                                                          • Instruction ID: f6c6d059f9b75f5cc6a79e0049e3afa1176d7e4558308c53008dbe788c85df41
                                                          • Opcode Fuzzy Hash: a52acb0b260d536fd7618f3e20de318eec4c6c539c6bb2def64801f0e67eaa78
                                                          • Instruction Fuzzy Hash: 3EE0C2338100206BC7211F0AED04B5E77AC6F48B22F054066FC407B3A08B742C418BCC
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 004057B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E004057B2(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}





                                                          0x004057b3
                                                          0x004057bd
                                                          0x004057bf
                                                          0x004057c6
                                                          0x004057ce
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x004057ce
                                                          0x004057d0
                                                          0x004057d5

                                                          APIs
                                                          • lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402CD2,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,80000000,00000003), ref: 004057B8
                                                          • CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402CD2,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,80000000,00000003), ref: 004057C6
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: CharPrevlstrlen
                                                          • String ID: C:\Users\user\Desktop
                                                          • API String ID: 2709904686-1669384263
                                                          • Opcode ID: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
                                                          • Instruction ID: 15550f116ff3ce815c4487a542d9ae56249738f0e4d38f85a76656e2d55d0e49
                                                          • Opcode Fuzzy Hash: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
                                                          • Instruction Fuzzy Hash: FAD0C7B2409D705EF31353149C08B9F6A58DF16700F195463E141EB591C6785D415BBD
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 100010E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E100010E0(void* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char* _t17;
				char _t19;
				void* _t20;
				void* _t24;
				void* _t27;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				signed int _t43;
				void* _t52;
				char* _t53;
				char* _t55;
				void* _t56;
				void* _t58;

				 *0x1000405c = _a8;
				 *0x10004060 = _a16;
				 *0x10004064 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x10004038, E10001556, _t52);
				_t43 =  *0x1000405c +  *0x1000405c * 4 << 2;
				_t17 = E1000123B();
				_a8 = _t17;
				_t53 = _t17;
				if( *_t17 == 0) {
					L16:
					return GlobalFree(_a8);
				} else {
					do {
						_t19 =  *_t53;
						_t55 = _t53 + 1;
						_t58 = _t19 - 0x6c;
						if(_t58 > 0) {
							_t20 = _t19 - 0x70;
							if(_t20 == 0) {
								L12:
								_t53 = _t55 + 1;
								_t24 = E10001266(E100012AD( *_t55 - 0x30));
								L13:
								GlobalFree(_t24);
								goto L14;
							}
							_t27 = _t20;
							if(_t27 == 0) {
								L10:
								_t53 = _t55 + 1;
								_t24 = E100012D1( *_t55 - 0x30, E1000123B());
								goto L13;
							}
							L7:
							if(_t27 == 1) {
								_t31 = GlobalAlloc(0x40, _t43 + 4);
								 *_t31 =  *0x10004030;
								 *0x10004030 = _t31;
								E10001508(_t31 + 4,  *0x10004064, _t43);
								_t56 = _t56 + 0xc;
							}
							goto L14;
						}
						if(_t58 == 0) {
							L17:
							_t34 =  *0x10004030;
							if( *0x10004030 != 0) {
								E10001508( *0x10004064, _t34 + 4, _t43);
								_t37 =  *0x10004030;
								_t56 = _t56 + 0xc;
								GlobalFree(_t37);
								 *0x10004030 =  *_t37;
							}
							goto L14;
						}
						_t39 = _t19 - 0x4c;
						if(_t39 == 0) {
							goto L17;
						}
						_t40 = _t39 - 4;
						if(_t40 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L12;
						}
						_t27 = _t40;
						if(_t27 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L10;
						}
						goto L7;
						L14:
					} while ( *_t53 != 0);
					goto L16;
				}
			}


















                                                          0x100010e7
                                                          0x100010ef
                                                          0x10001103
                                                          0x1000110b
                                                          0x10001116
                                                          0x10001119
                                                          0x10001121
                                                          0x10001124
                                                          0x10001126
                                                          0x100011c4
                                                          0x100011d0
                                                          0x1000112c
                                                          0x1000112d
                                                          0x1000112d
                                                          0x10001130
                                                          0x10001131
                                                          0x10001134
                                                          0x10001203
                                                          0x10001206
                                                          0x1000119e
                                                          0x100011a4
                                                          0x100011ac
                                                          0x100011b1
                                                          0x100011b4
                                                          0x00000000
                                                          0x100011b4
                                                          0x10001209
                                                          0x1000120a
                                                          0x10001186
                                                          0x1000118c
                                                          0x10001194
                                                          0x00000000
                                                          0x10001194
                                                          0x10001152
                                                          0x10001153
                                                          0x1000115b
                                                          0x10001168
                                                          0x10001170
                                                          0x10001179
                                                          0x1000117e
                                                          0x1000117e
                                                          0x00000000
                                                          0x10001153
                                                          0x1000113a
                                                          0x100011d1
                                                          0x100011d1
                                                          0x100011d8
                                                          0x100011e5
                                                          0x100011ea
                                                          0x100011ef
                                                          0x100011f5
                                                          0x100011fb
                                                          0x100011fb
                                                          0x00000000
                                                          0x100011d8
                                                          0x10001140
                                                          0x10001143
                                                          0x00000000
                                                          0x00000000
                                                          0x10001149
                                                          0x1000114c
                                                          0x1000119b
                                                          0x00000000
                                                          0x1000119b
                                                          0x1000114f
                                                          0x10001150
                                                          0x10001183
                                                          0x00000000
                                                          0x10001183
                                                          0x00000000
                                                          0x100011ba
                                                          0x100011ba
                                                          0x00000000
                                                          0x100011c3

                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.524434554.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.524374525.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          • Associated: 00000000.00000002.524488197.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          • Associated: 00000000.00000002.524503265.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: Global$Free$Alloc
                                                          • String ID:
                                                          • API String ID: 1780285237-0
                                                          • Opcode ID: b8decb074684892a2462dd8a14650f5bbc649040d1784db13741ef69c2ea5ccd
                                                          • Instruction ID: 5d3a3765e571093bf703368c32e31ec5bfeafbef09712c331e02e9e13643e521
                                                          • Opcode Fuzzy Hash: b8decb074684892a2462dd8a14650f5bbc649040d1784db13741ef69c2ea5ccd
                                                          • Instruction Fuzzy Hash: 6531ABB1808255AFF715CFA8DC89AEA7FE8EB052C1B164115FA45D726CDB34D910CB24
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 004058D1 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E004058D1(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}









                                                          0x004058e1
                                                          0x004058e3
                                                          0x004058e6
                                                          0x00405912
                                                          0x004058eb
                                                          0x004058f4
                                                          0x004058f9
                                                          0x00405904
                                                          0x00405907
                                                          0x00405923
                                                          0x00405909
                                                          0x00405910
                                                          0x00000000
                                                          0x00405910
                                                          0x0040591c
                                                          0x00405920
                                                          0x00405920
                                                          0x0040591a
                                                          0x00000000

                                                          APIs
                                                          • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004058E1
                                                          • lstrcmpiA.KERNEL32(00000000,00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004058F9
                                                          • CharNextA.USER32(00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040590A
                                                          • lstrlenA.KERNEL32(00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405913
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.513634567.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.513613500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513653706.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513677068.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.513913697.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                          Similarity
                                                          • API ID: lstrlen$CharNextlstrcmpi
                                                          • String ID:
                                                          • API String ID: 190613189-0
                                                          • Opcode ID: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
                                                          • Instruction ID: 481a9c588bbd1c68550dea5b76d7ebd72626077616c8f786d6c844a28ee3c139
                                                          • Opcode Fuzzy Hash: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
                                                          • Instruction Fuzzy Hash: 9EF0F632504418FFCB02AFA5DC0099EBBA8EF46360B2540B9F800F7310D274EF01ABA9
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%